Re: Signing Packages.gz

[Chris Frey <cdfrey@foursquare.net>]

Hi,

I'm curious how this issue is going to be handled now that it has been
discussed.  (The archives don't seem to be seeing any new messages on this
topic.)  What has to occur before this cryptographic signing of
Packages actually happens?

Does it need to become part of policy?  (in which case I kiss this idea
	good-bye as lost in the black-hole of bureaucracy?)

Does it need support software in apt? dpkg? something else?  (in which case
	I anxiously await for some developer to code this, or provide patches
	of my own which may never get applied?)

Could it be added to a script during this "dinstall" process?

Or is somebody already working on it and I just haven't heard?

I'm sure I'm showing my ignorance of how things work around here, but this
is one issue that I really don't want forgotten about.  And from some
comments I've seen, it shouldn't be that hard to implement.

Is there something I can do to help?  Helping you guys fix this would be
a way-better use of my time than compiling everything by hand.

Please don't let this die...

- Chris

P.S.  And if somebody tells me to wait for woody, I'm gonna have to lose
my mind. :-)