asdf-install updated in SBCL CVS

Having discovered that gpg has an alternate output mode which is
intended to be machine-parseable, I've just committed some exciting
new breakage to SBCL's asdf-install contrib to make it a bit smarter
about checking GPG signatures.  It now attempts to check signatures
for all packages no matter where they've come from, but there are
restarts to bypass most of the checks.

A package may

a) have no gpg signature at all
b) be signed by a gpg key you don't have on your keyring
c) be signed by a key on your keyring but which you don't have a trust
   relationship with (i.e. nobody you know has signed it)
d) be signed by a trusted key, but not be on the list of package
   suppliers (after all, just because you trust someone is who they say they
   are, you might not want to install their lisp software)

Presently (a) and (b) are terminal errors,  (c) can be ignored, and 
(d) has a restart that lets you add the packager to your package
supplier list.  The package supplier list is stored between sessions
in ~/.sbcl/trusted-uids.lisp

This is an incompatible change, especially for cclan packages.  I
think it makes sense anyway, though, and it's best to make these kind
of changes asap before people start seriously depending on the old
behaviour.

Feedback solicited, especially before 0.8.4 is released.


-dan

-- 

   http://www.cliki.net/ - Link farm for free CL-on-Unix resources

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQA/bQG1HDK5ZnWQiRMRAtNcAKDLNyTLbkNdZZSWED7A9zNoyqzWqwCeJ/Ff
L0s9tx/b9s2vZiY/icw8B/Y=
=aJEW
-----END PGP SIGNATURE-----