Re: [gnu-prog-discuss] Introducing GNU Guix

[Ludovic Courtès]

address@hidden (Niels Möller) skribis:

> address@hidden (Ludovic Courtès) writes:
>
>> The TODO item about signatures is to verify the OpenPGP signature that
>> comes with GNU packages.
>
> I see, then you don't have much choice on signature format. And I agree
> it's a useful feature.

Yes, though one could wonder how much it buys us if the committers are
trusted to have verified that they downloaded a genuine package when
they commit a file with the SHA256.

> You might like expressing authorizations as sexps (and I guess its
> possible to use the spki machinery even with alien input formats like
> openpgp).
>
> I was thinking of using spki delegations for things like "this key can
> authorize installation of packages from these urls" or "this key is
> authorized to install files in this subtree in the file system". But I
> haven't thought carefully about how that should work.

Hmm, OK.

Thanks,
Ludo’.