sm-discuss AT lists.ibiblio.org
Subject: Public SourceMage Discussion List
List archive
- From: David Kowis <dkowis AT shlrm.org>
- To: sm-discuss AT lists.ibiblio.org
- Subject: Re: [SM-Discuss] GPG verification
- Date: Thu, 22 Dec 2011 15:38:34 -0600
On 12/22/2011 01:08 PM, Sukneet Basuta wrote:
>>> Ismael Luceno (ismael.luceno AT gmail.com) wrote [11.12.13 12:14]:
>> <...>
>>>> So if we just save the hashes separately and sign that file, it
>>>> would have a similar effect. We should also think about allowing
>>>> several signatures.
>
> Based on your last e-mail, isn't that basically the same as signing
> the signature file? Which brings us back to the question of guru
> signing vs hashs. I believe it was decided that they are practically
> equivalent.
>
> On Sat, Dec 17, 2011 at 10:02 PM, flux <flux AT sourcemage.org> wrote:
>>
>> Let's keep pushing. :) I think we should do the following, in order:
>>
>> 1) Call for a vote regarding putting SIG_HASH= in all spells that use
>> upstream signatures. If this passes, then we would update the policy
>> accordingly that spell writes MUST add SIG_HASH when adding an upstream
>> signature file to use for a spell.
>>
>> 2) If (1) passes, then call for a vote for how to implement it in
>> sorcery (make it an optional check, required check, etc.), by when, etc.
My only concern with this order is that we're enforcing policy, without
any code to support the policy. What do we do if deadlines aren't met?
I'd much rather have the code ready in a patch able to be applied before
trying to enforce this. I would say that's a prerequisite before we can
vote to enforce this.
David
>>
>> If this seems like a good idea, and nobody else makes the call, I'll
>> call for the vote.
>
> If that's a call for a vote, I second the motion.
> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss
>
> !DSPAM:2,4ef38058263671804284693!
>
Attachment:
signature.asc
Description: OpenPGP digital signature
-
Re: [SM-Discuss] GPG verification
, (continued)
- Re: [SM-Discuss] GPG verification, flux, 12/13/2011
- Re: [SM-Discuss] GPG verification, Ismael Luceno, 12/22/2011
- Re: [SM-Discuss] GPG verification, Sukneet Basuta, 12/22/2011
- Re: [SM-Discuss] GPG verification, Ismael Luceno, 12/22/2011
- Re: [SM-Discuss] GPG verification, Sukneet Basuta, 12/22/2011
- Re: [SM-Discuss] GPG verification, Ismael Luceno, 12/22/2011
- Re: [SM-Discuss] GPG verification, Thomas Orgis, 12/23/2011
- [SM-Discuss] e-17 section, Robin Cook, 12/27/2011
- Re: [SM-Discuss] e-17 section, Thomas Orgis, 12/28/2011
- [SM-Discuss] new automake 1.11.2, Robin Cook, 12/28/2011
- Re: [SM-Discuss] GPG verification, David Kowis, 12/22/2011
Archive powered by MHonArc 2.6.24.