Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] GPG verification

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: David Kowis <dkowis AT shlrm.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] GPG verification
  • Date: Thu, 22 Dec 2011 15:38:34 -0600

On 12/22/2011 01:08 PM, Sukneet Basuta wrote:
>>> Ismael Luceno (ismael.luceno AT gmail.com) wrote [11.12.13 12:14]:
>> <...>
>>>> So if we just save the hashes separately and sign that file, it
>>>> would have a similar effect. We should also think about allowing
>>>> several signatures.
>
> Based on your last e-mail, isn't that basically the same as signing
> the signature file? Which brings us back to the question of guru
> signing vs hashs. I believe it was decided that they are practically
> equivalent.
>
> On Sat, Dec 17, 2011 at 10:02 PM, flux <flux AT sourcemage.org> wrote:
>>
>> Let's keep pushing. :) I think we should do the following, in order:
>>
>> 1) Call for a vote regarding putting SIG_HASH= in all spells that use
>> upstream signatures. If this passes, then we would update the policy
>> accordingly that spell writes MUST add SIG_HASH when adding an upstream
>> signature file to use for a spell.
>>
>> 2) If (1) passes, then call for a vote for how to implement it in
>> sorcery (make it an optional check, required check, etc.), by when, etc.

My only concern with this order is that we're enforcing policy, without
any code to support the policy. What do we do if deadlines aren't met?

I'd much rather have the code ready in a patch able to be applied before
trying to enforce this. I would say that's a prerequisite before we can
vote to enforce this.

David

>>
>> If this seems like a good idea, and nobody else makes the call, I'll
>> call for the vote.
>
> If that's a call for a vote, I second the motion.
> _______________________________________________
> SM-Discuss mailing list
> SM-Discuss AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-discuss
>
> !DSPAM:2,4ef38058263671804284693!
>


Attachment: signature.asc
Description: OpenPGP digital signature




Archive powered by MHonArc 2.6.24.

Top of Page