>>>>> On Wed, 2 Aug 2000 10:14:37 +0100, Graham Barr <[EMAIL PROTECTED]> said:
>> My idea was to have the complete list of contained files, each with a
>> checksum. This can be signed then. A signature that is produced this
>> way can be included in the distribution file and doesn't need to be
>> distributed separately. Distributing separately is considered annoying
>> and errorprone.
> I had a thought about this. What is this actually giving us. It obviously
> gives some comfort if the dist is signed by it's author. But what is
> to stop some evil person you hacks some CPAN FTP site from just removing
> the signature when they corrupt a distribution. Maybe pause could create
> signatures for non-signed uploads.
I had the imagination that the author would store a policy on PAUSE
for uploads into his directory, and that the user would store a
per-author policy for handling downloaded files from CPAN.
If the author would decide in favor of policy "strict", PAUSE would
not accept uploads that are not signed by exactly that author. I do
not envision other policies except "strict" and "not strict".
If users would decide for the policy {"GBARR"=>"strict"}, they would
not let their software install anything by GBARR that is not signed by
GBARR. Users could have a default policy for all authors except those
in the per-name policy list. Another policy besides strict would be
"ask", I suppose. There may be more.
A signature by PAUSE is an interesting idea. But it would tell the
user something different than a signature by a person. While I imagine
that a sig by GBARR would mean something like: "I have written or at
least doublechecked the code in this package to be free from malicious
intent. This is not a warranty." (careful considerations about wording
pending). A signature of the PAUSE could only mean "These checksums
were valid at the time of the upload."
>> > What else would people like to see besides author, email, name, version,
>> > url, signature, dependancies....???
>>
>> I'd like to NOT have author's name and email in there because that is
>> redundant information and tends to get out of date.
> So does the README. It may be redundant due to the fact that it is in an authors
> directory on CPAN. But once the distribution leaves CPAN that knowledge is
> lost and having it in the OSD gives a KNOWN place to find such information.
>> Author's credentials are not in the OSD, right?
> Right.
>> But
>> they are in the PPD. Hmmm. I'd say, it should go away. The CPAN ID is
>> fine, it is associated with a record in a public database and the
>> record can be edited by the person. PAUSE could refuse an upload if
>> the ID in the OSD isn't the same as the person doing the upload or
>> some such.
> Would you always want to force that. For example why would the perl distribution
> not be able to set the field to <[EMAIL PROTECTED]> ?
Who has the private key of the perl5-porters? I believe, the signing
must remain a strictly personal testimony. We should be prepared to
let many people sign something, e.g. a release manager makes the
release and asks the pumpking to also sign. But a group as such can
only be presented by one signature for each member.
--
andreas
