Re: ASDF-Install patch to allow installation of unsigned packages

Hi Gary,

I'd just like to add my small voice to the chorus:

On May 24, 2007, at 10:40 AM, Gary King wrote:

>
> I see your point regarding requiring a license file but I'm not sure
> that I agree because ASDF-Install already has several "loopholes":
>
> * you can set *verify-gpg-signatures* to nil or to a list of trusted
> locations
> * you can choose a restart around an invalid or untrusted signature
>

It seems to me that these are choices made by the person installing a  
package, whereas making a package without a signature is a choice  
made by the person providing the package.  I'm okay with opting out  
of the signature verification on my end if it's expedient, but I'm  
not really down with a potential proliferation of unsigned packages.   
In my world, an unsigned package should not be called ASDF-INSTALLable.

Cheers,
Tim



-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/