Aaron Bentley wrote:
John Arbash Meinel wrote:
Why not put both detached signatures into the checksum file?
It's not 'both', it's 'all', and in many cases, 'all' is 4 or more files. That's a lot of times to enter your password for signing.
(gpg: --clearsign does not yet work with --multifile)
Aaron
Again, my feeling was to make it expandable, so that if someone wants to turn on gpg signing, they know in advance that they should probably set up a gpg-agent of some sort. Actually, since baz now requests 2 signatures on a commit, it motivated me to set up gpg-agent.
We're working on ways of bringing it back down to 1. It may require an archive format bump, though.
My statement was to let people be as paranoid as they want to be. If they don't want an agent and want to sign 4 times, let them.
My sentiment is "let's not punish people who want to operate in a secure fashion".
I wasn't advocating that it was the default.
Okay, I wasn't clear on that before.
Remember, doing a "tag" already requires 2 sigs, because it does a cacherev.
Well, only when you tag from a different archive. It doesn't do a cacherev if the direct ancestor is in the same archive.
Aaron -- Aaron Bentley Director of Technology Panometrics, Inc.
_______________________________________________ Gnu-arch-users mailing list Gnu-arch-users@gnu.org http://lists.gnu.org/mailman/listinfo/gnu-arch-users
GNU arch home page: http://savannah.gnu.org/projects/gnu-arch/
