| 1 |
On Sunday 07 September 2003 23:41, Chris Bainbridge wrote: |
| 2 |
> This has been discussed before ( |
| 3 |
> http://bugs.gentoo.org/show_bug.cgi?id=5902 ). I think the gpg signatures |
| 4 |
> development got put on hold because there was talk of making individuals |
| 5 |
> responsible for packages (like Debian), rather than the system at the |
| 6 |
> moment where a small core does all of the work. |
| 7 |
Thank you for this information. Sounds good :) |
| 8 |
unfortunatly i read it after i answered the mail of Jon Portnoy. |
| 9 |
|
| 10 |
> My proposal was to use signatures along with the concept of requiring a |
| 11 |
> certain number of developers to "sign off" an ebuild. Its important that |
| 12 |
> the compromise of a single developer with cvs access shouldn't impact |
| 13 |
> thousands of users. Therefore, most packages should require two or more |
| 14 |
> developer signatures before they will be installed. |
| 15 |
Sounds good too :) |
| 16 |
|
| 17 |
> Using a secure distribution infrastructure (eg. rsync over ssl) is not an |
| 18 |
> option if gentoo is going to be distributed over untrusted p2p networks |
| 19 |
> (which I think it will in the future). |
| 20 |
Ok, forget about ssl/ssh for now. |
| 21 |
|
| 22 |
Jan |
| 23 |
|
| 24 |
|
| 25 |
-- |
| 26 |
gentoo-dev@g.o mailing list |
Archives