>> -----Original Message-----
>> From: pgadmin-hackers-owner@postgresql.org
>> [mailto:pgadmin-hackers-owner@postgresql.org] On Behalf Of
>> Troels Arvin
>> Sent: 03 December 2004 14:10
>> To: pgadmin-hackers@postgresql.org
>> Subject: Re: [pgadmin-hackers] New ftp layout
>>
>> 2. I suggest that CURRENT_MAINTAINER files be added
>> in the RPM-directories. The files should -
>> apart from our names, etc. - contain a link to
>> the relevant public key of the packager, i.e.
>> http://troels.arvin.dk/pgp/
>> or
>> http://www.gunduz.org/devrimgunduz.pgp.pub
>
>Yup, I just haven't got around to that yet (I only added them to the
>existing layout a couple of days ago).
Can you explain something to me? Why don't you /simply/ upload your key to a keyserver?
To me, gpg signing is efficient if (at least):
- your key is available from a third party
- your key is signed by someone you trust
- you have all the required files to inform people the key has been compromised. IMHO, uploading your key to a public
keyservermakes it mandatory for you to generate revocation certificates... Something you may not do if your key is not
muchdistributed.
- your private key is protected (I mean not on a host on the net)
I bet we won't be able to sign each other but why not (Hey Dave, still ok for next summer holidays ? ;p)
The only pub key I distribute in the deb repo is the key used to sign debian unofficial repository release files. This
keyis not on keyserver because it does not meet the above requirements.
Having the key on a keyserver helps getting the pub keys rapidly as people first think the key is available on a
keyserver(?).
Thanks for teaching me,
Raphaël
