[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: RFC: Signed packages and translations



On 01-09-01 Simon Richter wrote:
> not be ascii armored since this would only introduce transmission overhead
> and gain nothing. The file name for this file is constructed from the

Why does it gain nothing? What about problems during transmission? The
ascii armor output which is protected by a crc checksum would help
notice such a transmission problem.

> If the original filename is no more than sizeof(ar_name)-2 bytes long, ".s"
> is appended to it. If it is longer, the part of the file name before the

.s? Another new extension? If you want to achive confusion for our users
and developers, that's a possible way to go. If you really don't want to
use ascii armor, then the extension should be .sig or if you use
ascii-armor then .asc. 

>  - An end user can verify who built the .deb file.

And how many developers does a end user personally know, so that he
trust them? In my humble opinion, this will not gain anything for the
end-users. 

>  - Modify the autobuilders and existing developer scripts ("debsign") so
>    that they call dpkg-deb to sign the packages additionally to signing the
>    .changes file.

Sign packages build by an auto-builder? 

Christian
-- 
           Debian Developer (http://www.debian.org)
1024/26CC7853 31E6 A8CA 68FC 284F 7D16  63EC A9E6 67FF 26CC 7853

Attachment: pgpmhyG1tHe21.pgp
Description: PGP signature


Reply to: