Re: Gnome.org's crypto infrastructure

2014-07-08 Thread Ray Strode
Hi, > I think the opposite is true as well, in that some software needs > other frameworks in place to do "distcheck" rather than "check" -- for > instance colord needs a running colord daemon to test against. Other > software needs X. Well, maybe it could do it in a gnome-continuous VM or somethi

Re: Gnome.org's crypto infrastructure

2014-07-08 Thread Richard Hughes
On 8 July 2014 13:24, Ray Strode wrote: > 1) tarballs would be generated with a standardized set of autotools, > instead of whatever the maintainer happens to have installed I think the opposite is true as well, in that some software needs other frameworks in place to do "distcheck" rather than "

Re: Gnome.org's crypto infrastructure

2014-07-08 Thread Ray Strode
Hi, > * GNOME releases tarballs of source code. Maintainers regularly post > checksums of their tarballs along with their announcement emails. Until > now, I'm not sure if we have had the need to *guarantee* that a > particular release of code is authentic. For example, we don't actually > cryp

Re: Gnome.org's crypto infrastructure

2014-07-08 Thread Allan Day
Hey Federico, Federico Mena Quintero wrote: ... > This mail is intended for brainstorming some ideas before GUADEC. It's > not to decide anything and set it in stone. ... There's a GSoC project that's focusing on keysigning this summer - https://www.google-melange.com/gsoc/project/details/googl

Gnome.org's crypto infrastructure

2014-07-03 Thread Federico Mena Quintero
Hi, all, This mail is intended for brainstorming some ideas before GUADEC. It's not to decide anything and set it in stone. I've been preparing my GUADEC talk about crypto infrastructure for newbies, and I've started to realize that it may be useful for gnome.org to have an "official", publicly-