Public SourceMage Discussion List

[Sukneet Basuta <sukneet AT gmail.com>]

>> Ismael Luceno (ismael.luceno AT gmail.com) wrote [11.12.13 12:14]:
> <...>
>> > So if we just save the hashes separately and sign that file, it
>> > would have a similar effect. We should also think about allowing
>> > several signatures.

Based on your last e-mail, isn't that basically the same as signing
the signature file? Which brings us back to the question of guru
signing vs hashs. I believe it was decided that they are practically
equivalent.

On Sat, Dec 17, 2011 at 10:02 PM, flux <flux AT sourcemage.org> wrote:
>
> Let's keep pushing. :) I think we should do the following, in order:
>
> 1) Call for a vote regarding putting SIG_HASH= in all spells that use
> upstream signatures. If this passes, then we would update the policy
> accordingly that spell writes MUST add SIG_HASH when adding an upstream
> signature file to use for a spell.
>
> 2) If (1) passes, then call for a vote for how to implement it in
> sorcery (make it an optional check, required check, etc.), by when, etc.
>
> If this seems like a good idea, and nobody else makes the call, I'll
> call for the vote.

If that's a call for a vote, I second the motion.