Re: (no subject)

   Consider a typical ASDF-Install interaction wherein the user does not  
   have the packager's public key:

   > Error:
   > No key found for key id 0xB9C0C05804D7F45F.
   > Try some command like
   >   gpg  --recv-keys 0xB9C0C05804D7F45F
   >   [condition type: key-not-found]
   >
   > Restart actions (select using :continue):
   >  1: Retry GPG check (e.g., after downloading the key)

   The error message suggests calling 'gpg'. Is there a good reason to  
   not include a restart that offers to call it for the user?


A strong security mind would point out that would allow any evil
process installed by a corrupted asdf-install package to potentially
adjust any such downloaded key, i.e. you would potentially be breaking
down the security barriers designed to isolate and protect against
intrusion.  Basically you want independence in the key-fetch and
key-usage processes.

Average Joe user wouldn't care of course, and I doubt that you do
either.  Perhaps with a *warning*.  Since I'm tired of all the spam
and clone armies, I think the current independent setup is fine.


-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >>  http://get.splunk.com/