Bugs for Sorcery are reported here

[bugzilla-daemon AT bugs.sourcemage.org]

http://bugs.sourcemage.org/show_bug.cgi?id=9515





------- Additional Comments From jblosser-smgl AT firinn.org  2005-08-26 15:42 
-------
(In reply to comment #5)
> Okay so beyond the level system you want to be able to specify a minimum 
> hash
> for both gpg and the *sum methods.

It probably wouldn't be a 'minimum', it would be a list of allowed and/or not
allowed hashes.

> if someone could draw up the hierarchy of all the *sums and gpg's that'd be
> nice, it would explain to the users (when given all these options) what they
> mean and what their significance is.

The levels and what they mean are defined in the URL referenced above.

The hashes used by GPG for signatures are going to change over time, and part 
of
the reason we're using GPG is so we don't have to worry about them, so I
wouldn't worry too much about documenting them ourselves.  The default should 
be
to allow signatures to use any hash method so that all upstream stuff will
install; users that care can choose to be restrictive about what hashes they
will allow without some kind of warning or failure being presented to them in
bug 8579's output.

For the interface we'd probably want to first offer them something like:

[o] allow any hash algorithm
[ ] allow only selected algorithms
[ ] allow all except selected algorithms

[select algorithms]

Then the select algorithms screen would be generated based on 'gpg --version |
grep '^Hash:' and any existing previously-configured manual hash selections.

> also presenting these options it'd be nice to know what we 'officially' 
> consider
> a better hash or a better gpg signature.

Well, we will have a documented minimum for our own signatures.  Currently 
that
is set at sha256.

-- 
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.