Re: [gnu-prog-discuss] Introducing GNU Guix

[Ludovic Courtès]

Hi Niels,

address@hidden (Niels Möller) skribis:

> address@hidden (Ludovic Courtès) writes:
>
>> The TODO file details some of the many ways you can help.
>
> Regarding signatures, have you had a look at spki style signatures and
> delegations/certificates?

I’ve read about SPKI in the past, but I’m not sure where you’d use them here.

The TODO item about signatures is to verify the OpenPGP signature that
comes with GNU packages.  Currently, for source tarballs used by Guix,
only the integrity is checked, by making sure it has the expected
SHA256.  Checking against OpenPGP signatures would also allow us to
automatically check the authenticity of these packages, like GSRC does.

Thanks,
Ludo’.