Public SourceMage Discussion List

[Ismael Luceno <ismael.luceno AT gmail.com>]

On Thu, 22 Dec 2011 14:08:45 -0500
Sukneet Basuta <sukneet AT gmail.com> wrote:
> >> Ismael Luceno (ismael.luceno AT gmail.com) wrote [11.12.13 12:14]:
> > <...>
> >> > So if we just save the hashes separately and sign that file, it
> >> > would have a similar effect. We should also think about allowing
> >> > several signatures.
> 
> Based on your last e-mail, isn't that basically the same as signing
> the signature file? Which brings us back to the question of guru
> signing vs hashs. I believe it was decided that they are practically
> equivalent.
> 

I'm talking about something else. What I would like is to make hashes
mandatory for all downloaded files (thus handling upstream signatures
like any other file), but have them on a separate file, so we can
optionally sign it.

The point to signing that file is the same as signing individual
files, to make it clear *who* verified it...

Attachment: signature.asc
Description: PGP signature