Skip to Content.
Sympa Menu

sm-sorcery-bugs - [SM-Sorcery-Bugs] [Bug 8047] gpg checking for spells

sm-sorcery-bugs AT lists.ibiblio.org

Subject: Bugs for Sorcery are reported here

List archive

Chronological Thread  
  • From: bugzilla-daemon AT bugs.sourcemage.org
  • To: sm-sorcery-bugs AT lists.ibiblio.org
  • Subject: [SM-Sorcery-Bugs] [Bug 8047] gpg checking for spells
  • Date: Thu, 20 Jan 2005 16:39:07 -0800 (PST)

http://bugs.sourcemage.org/show_bug.cgi?id=8047


hgr AT vabo.cz changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |hgr AT vabo.cz




------- Additional Comments From hgr AT vabo.cz 2005-01-20 16:39 -------
Link to discussion about gnupg signatures in SM-Discuss:
https://lists.ibiblio.org/sympa/arc/sm-discuss/2004-December/008818.html

I agree with Andrew, we probably do not need gpg signatures for sources. Of
course if gpg signatures are officially offered by vendors (for example linux)
we should use it. Problems are if sources are signed randomly by one of twenty
developers.

Quite often vendors change sources but do not modify version number. According
to them it is only small change, they do not want to increse version number.
Now
our users can discuss about it, they can compare their MD5sums. With source
signature they had to wait for Source Mage developer to sign it.

After accapted this IMHO it will be more work for our developers, for example
change SOURCE_GPG_KEY= from swoolley.gpg to lace.gpg. Of course it may be
automated, name of developer can be extract from HISTORY file of spell.

I should only replace MD5 by SHA1 (sha1sum from coreutils). There are some
"theoretic" problems with MD5.



--
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.




Archive powered by MHonArc 2.6.24.

Top of Page