Re: Mirror layout proposal

--===============61402165242407492==
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature";
	boundary="=-MPo44EhVHT535MRA68kw"


--=-MPo44EhVHT535MRA68kw
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

On Fri, 2003-08-01 at 16:37, Graham Forest wrote:
> Ok, so in response to the responses:
 SNiP=20
>=20
> * No comments on where gpg signatures should go - Security guys, we
> actually need a whole new approach at this, not only for distfiles, but
> also for build scripts.

I think that they should come with the files of the package .. mainly
for ease of packaging. distribute them with the package to the mirrors.
theres no reason to corral  the sigs. If any mirror mucks with a sig its
invalidated.=20

The exception has got to be how we handle getting the "key ring" to the
user. I had proposed we have 2 signing keys just for the key ring and
that porteous or whatever it becomes will sync->install this
non-interactively. As well as check the sigs on that package against our
published pubkeys ( http/ldap/pgp keyserver).. This package can be
distributed to the mirrors, but it should never be installed without
first checking the sigs against an external source. =20

as for distfiles. I would like to see a mechanisim for shipping the
original sigs for these things.. tho i havent worked out how yet :P=20

i see distfiles sigs all being in one big directory as well
/distfiles/sigs/*.sig  untill somthing better with distfiles is worked
out.=20

> Thanks,
> Graham
>=20
> ______________________________________________________________________
> _______________________________________________
> Zynaut mailing list
> [email protected]
> http://lists.zynot.org/mailman/listinfo/zynaut
I opened the drawer of my little desk and a single letter fell out, a
letter from my mother, written in pencil, one of her last, with
unfinished words and an implicit sense of her departure. It's so
curious: one can resist tears and "behave" very well in the hardest
hours of grief. But then someone makes you a friendly sign behind a
window... or one notices that a flower that was in bud only yesterday
has suddenly blossomed... or a letter slips from a drawer... and
everything collapses. -- Letters From Colette

--=-MPo44EhVHT535MRA68kw
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQA/KwTh4rKvBkfUvb0RAtgmAJ9AjLkvdbcQmgRJ9v3wCUhWWG3A2ACfUnxr
/F74vBtTg27ACCpdh/NcJqo=
=pXuv
-----END PGP SIGNATURE-----

--=-MPo44EhVHT535MRA68kw--


--===============61402165242407492==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Zynaut mailing list
[email protected]
http://lists.zynot.org/mailman/listinfo/zynaut

--===============61402165242407492==--