Re: asdf-install and pgp

Daniel Barlow <[email protected]> writes:

> [ this email goes to cclan-list because packaging and installation
> tools are the kind of thing it's about, and to Miles and Edi
> personally because they now have asdf-installable versions of their
> software packages linked fron CLiki ]
> 
> If we are to automatically download and run code from
> freely-editable links on the internet, I think that some form of
> authentication of the code is required, and PGP to verify the source
> is a good place to start.  It does open up a whole "who do you
> trust" can of worms, though, in that the effort you might once have
> spent finding sources you now have to spend getting and verifying
> PGP keys
> 
> I've just retrieved Miles' key from the keyservers 
> 
>   pub  1024/01F53D51 2002-06-04            
> 	   Fingerprint=E323 24E0 932E 9419 797E D8B3 5382 6AFF 01F5 3D51 
> 
> (not the same key as is posted on the SBCL web page for him,
> incidentally) and it matches all the PGP-signed mail I've had from
> him over the past few months , so I'm thinking that probably merits
> a "(2) I have done casual checking" signature.  (I reserve (3) for
> physical meeting with proof of id).  I don't think that approach
> scales, though, and it's certainly not much good for new users
> 
> Any ideas?  One thought that occurs to me is that there seem to be
> Debian developers in many places; if we could all get keys signed by
> well-connected Debian developers, that might join the dots between
> us a bit.  Still doesn't solve the new-user problem, though

No ideas, currently. I just wanted to say that I've read about
asdf-install today and think it's a good thing, that's why I made an
asdf-install link for CL-PPCRE.

Actually, I didn't have a key yet and just generated one for this
purpose. I'm open to all solutions but (a) I'm not a Debian developer
and (b) I think I haven't met anyone involved in CCLAN physically.

One other thing: I just noted that you seem to use '_' (underline) to
separate the name of the package from its version number. I currently
use '-' (hyphen) - does that mean it won't work if I release a new
package? No problem for me to switch to '_' but I'll have to ask Kevin
if it breaks his Debian package.

Cheers,
Edi.


-------------------------------------------------------
This SF.net email is sponsored by:  Etnus, makers of TotalView, The best
thread debugger on the planet. Designed with thread debugging features
you've never dreamed of, try TotalView 6 free at www.etnus.com.