Re: PROPOSAL: GPG Signing of Releases

Okay. My feeling, after reading the whole thread, is that we should

   a) Forget about the shared key for now.

   b) Make sure that three or four developers sign each release.

   c) Make an effort to get all developer's keys into well-connected
      trust networks (pretty easy, considering that we have a high
      degree of personal contact/overlap with other projects like
      Debian, Apache, etc).

I hope Ben Reser will forgive me for (a), considering that I was in
favor of a shared key before... Two things changed my mind:

   1. It would have made the CollabNet developers "special" when it
      comes to releases. (Although this specialness wasn't a
      necessary property of the system, it would have been the path of
      least resistance for a while.)

   2. It complexifies the whole system generally. Everyone's got
      their own ways to manage their personal keys. But with a shared
      key, we have to coordinate how to manage it.

   3. While we *think* the shared key would be easier for users, do we
      actually know this? IOW, premature optimization.

So, how do people feel about this simplified version of Ben Reser's
proposal?

-Karl

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Received on Thu Apr 8 23:09:34 2004