Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] GPG verification

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Ismael Luceno <ismael.luceno AT gmail.com>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] GPG verification
  • Date: Thu, 22 Dec 2011 18:15:08 -0200

On Thu, 22 Dec 2011 14:08:45 -0500
Sukneet Basuta <sukneet AT gmail.com> wrote:
> >> Ismael Luceno (ismael.luceno AT gmail.com) wrote [11.12.13 12:14]:
> > <...>
> >> > So if we just save the hashes separately and sign that file, it
> >> > would have a similar effect. We should also think about allowing
> >> > several signatures.
>
> Based on your last e-mail, isn't that basically the same as signing
> the signature file? Which brings us back to the question of guru
> signing vs hashs. I believe it was decided that they are practically
> equivalent.
>

I'm talking about something else. What I would like is to make hashes
mandatory for all downloaded files (thus handling upstream signatures
like any other file), but have them on a separate file, so we can
optionally sign it.

The point to signing that file is the same as signing individual
files, to make it clear *who* verified it...

Attachment: signature.asc
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page