Mailing-List: contact general-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: general@incubator.apache.org
Received-SPF: pass (nike.apache.org: local policy)
Message-ID: <NBBBJGEAGJAKLIDBKJOPOEFCEPAD.noel@devtech.com>
MIME-Version: 1.0
From: "Noel J. Bergman" <noel@devtech.com>
To: <general@incubator.apache.org>
Subject: RE: enforced signing of artifacts, [was maven repository]
Date: Mon, 2 Jun 2008 18:09:11 -0400
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
In-Reply-To: <f470f68e0806021139we158217kcb9a1b85396f8f5@mail.gmail.com>
Importance: Normal

Robert Burrell Donkin wrote:

> my conclusion was that meta-data signed by [keys in the] WoT would be good
enough.

> there's no need to distribute a master key

+1

> key management is tricky

Not that tricky.  Let's not make as if this isn't done routinely elsewhere.

> this is where the complexity lies. IIRC it was quite tough to come up
> with a user friendly trust model that worked correctly.

Not so much, seeing as how you just agreed with CLR:

> For example, "trust all unsigned", "trust all signed", "trust all signed
in
> Apache WOT" might be reasonable policies declared by the user.

> we don't actually require that the artifacts are signed: just
> meta-data about the artifacts

What do you think a signature is in the first place?  It is a digitally
encrypted hash, i.e., meta-data.

	--- Noel


---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org