Re: [avrdude-dev] Windows Installer

[Theodore A. Roth]

On Fri, 23 Jan 2004, Joerg Wunsch wrote:

> As Theodore A. Roth wrote:
>
> > Of note is the comment by James Hess. I recommend that anyone with
> > upload permission please do not distribute signed files unless you plan
> > to upload them since any file you have signed could be uploaded by
> > anyone to any project you have upload rights to. We currently have no
> > way of removing files from the download areas once they are in place.
>
> Sigh.  This effectively means I can't use my regular PGP/GPG key for
> it but have to create a new one.  Obviously, this one won't have any
> trust except my own, because for sure, I won't start having it signed
> by a number of different people as I did for my main key.  So in
> effect, this measure is merely counterproductive in many ways.

I don't think that this will (or should) affect cvs commits, only file
uploads. I don't think you need to generate a special key since you
could just have someone else upload a file for you.

Ted Roth