Re: Gnome.org's crypto infrastructure

2014-07-08 Thread Allan Day
Hey Federico, Federico Mena Quintero feder...@gnome.org wrote: ... This mail is intended for brainstorming some ideas before GUADEC. It's not to decide anything and set it in stone. ... There's a GSoC project that's focusing on keysigning this summer -

Re: Gnome.org's crypto infrastructure

2014-07-08 Thread Ray Strode
Hi, * GNOME releases tarballs of source code. Maintainers regularly post checksums of their tarballs along with their announcement emails. Until now, I'm not sure if we have had the need to *guarantee* that a particular release of code is authentic. For example, we don't actually

Re: Gnome.org's crypto infrastructure

2014-07-08 Thread Richard Hughes
On 8 July 2014 13:24, Ray Strode halfl...@gmail.com wrote: 1) tarballs would be generated with a standardized set of autotools, instead of whatever the maintainer happens to have installed I think the opposite is true as well, in that some software needs other frameworks in place to do

Re: Gnome.org's crypto infrastructure

2014-07-08 Thread Ray Strode
Hi, I think the opposite is true as well, in that some software needs other frameworks in place to do distcheck rather than check -- for instance colord needs a running colord daemon to test against. Other software needs X. Well, maybe it could do it in a gnome-continuous VM or something like

Gnome.org's crypto infrastructure

2014-07-03 Thread Federico Mena Quintero
Hi, all, This mail is intended for brainstorming some ideas before GUADEC. It's not to decide anything and set it in stone. I've been preparing my GUADEC talk about crypto infrastructure for newbies, and I've started to realize that it may be useful for gnome.org to have an official,