Re: [arch-dev-public] Finalizing the package signing process

2011-10-31 Thread Stéphane Gaudreault
Le 30 octobre 2011 14:12:20 Pierre Schmitz a écrit : > Hi all, > > it's about time to finalize our signing policy to get all our packages > properly signed as soon as possible. Note that this is just about > signing the package itself. How we will manage our keyring and sign that > one using maste

Re: [arch-dev-public] Finalizing the package signing process

2011-10-30 Thread Ray Rashif
On 31 October 2011 01:56, Daniel Isenmann wrote: > I'm building my packages exclusive on pkgbuild.com and there I can't > sign packages. If we do the switch in dbscripts then pkgbuild.com > should be ready to generate signed packages. As far as I know it isn't > possible yet, am I right? > > Other

Re: [arch-dev-public] Finalizing the package signing process

2011-10-30 Thread Eric Bélanger
On Sun, Oct 30, 2011 at 9:12 AM, Pierre Schmitz wrote: > Hi all, > > it's about time to finalize our signing policy to get all our packages > properly signed as soon as possible. Note that this is just about > signing the package itself. How we will manage our keyring and sign that > one using mas

Re: [arch-dev-public] Finalizing the package signing process

2011-10-30 Thread Guillaume ALAUX
On 30 October 2011 22:47, Daniel Isenmann wrote: > On Sun, 30 Oct 2011 21:58:35 +0100 > Tom Gundersen wrote: > >> On Sun, Oct 30, 2011 at 9:38 PM, Daniel Isenmann >> wrote: >> >> I don't think signing remotely is going to be possible, also I >> >> don't see the point of it. We anyway have to dow

Re: [arch-dev-public] Finalizing the package signing process

2011-10-30 Thread Gaetan Bisson
[2011-10-30 14:12:20 +0100] Pierre Schmitz: > If you just agree with all this send a +1. I agree with all this. -- Gaetan

Re: [arch-dev-public] Finalizing the package signing process

2011-10-30 Thread Daniel Isenmann
On Sun, 30 Oct 2011 21:58:35 +0100 Tom Gundersen wrote: > On Sun, Oct 30, 2011 at 9:38 PM, Daniel Isenmann > wrote: > >> I don't think signing remotely is going to be possible, also I > >> don't see the point of it. We anyway have to download the package > >> in order to test it, so we wouldn't

Re: [arch-dev-public] Finalizing the package signing process

2011-10-30 Thread Tom Gundersen
On Sun, Oct 30, 2011 at 9:38 PM, Daniel Isenmann wrote: >> I don't think signing remotely is going to be possible, also I don't >> see the point of it. We anyway have to download the package in order >> to test it, so we wouldn't really gain anything. > > Not all packages have to be tested, e.g. a

Re: [arch-dev-public] Finalizing the package signing process

2011-10-30 Thread Daniel Isenmann
On Sun, 30 Oct 2011 21:32:25 +0100 Tom Gundersen wrote: > On Sun, Oct 30, 2011 at 9:05 PM, Daniel Isenmann > wrote: > > As it seems that there is no real solution here, I will try to do it > > like Florian and Giovanni said it. Downloading the package, sign it > > locally and upload the signatur

Re: [arch-dev-public] Finalizing the package signing process

2011-10-30 Thread Tom Gundersen
On Sun, Oct 30, 2011 at 9:05 PM, Daniel Isenmann wrote: > As it seems that there is no real solution here, I will try to do it > like Florian and Giovanni said it. Downloading the package, sign it > locally and upload the signature to pkguild again. > > Nevertheless we should find a solution to bu

Re: [arch-dev-public] Finalizing the package signing process

2011-10-30 Thread Daniel Isenmann
On Sun, 30 Oct 2011 19:50:43 +0100 Pierre Schmitz wrote: > Am 30.10.2011 19:13, schrieb Daniel Isenmann: > > On Sun, 30 Oct 2011 19:04:51 +0100 > > Giovanni Scafora wrote: > > > >> Il 30/10/2011 18:56, Daniel Isenmann ha scritto: > >> > I'm building my packages exclusive on pkgbuild.com and the

Re: [arch-dev-public] Finalizing the package signing process

2011-10-30 Thread Pierre Schmitz
Am 30.10.2011 19:13, schrieb Daniel Isenmann: > On Sun, 30 Oct 2011 19:04:51 +0100 > Giovanni Scafora wrote: > >> Il 30/10/2011 18:56, Daniel Isenmann ha scritto: >> > I'm building my packages exclusive on pkgbuild.com and there I can't >> > sign packages. If we do the switch in dbscripts then pk

Re: [arch-dev-public] Finalizing the package signing process

2011-10-30 Thread Dieter Plaetinck
On Sun, 30 Oct 2011 14:12:20 +0100 Pierre Schmitz wrote: > Hi all, > > it's about time to finalize our signing policy to get all our packages > properly signed as soon as possible. Note that this is just about > signing the package itself. How we will manage our keyring and sign > that one using

Re: [arch-dev-public] Finalizing the package signing process

2011-10-30 Thread Daniel Isenmann
On Sun, 30 Oct 2011 19:04:51 +0100 Giovanni Scafora wrote: > Il 30/10/2011 18:56, Daniel Isenmann ha scritto: > > I'm building my packages exclusive on pkgbuild.com and there I can't > > sign packages. If we do the switch in dbscripts then pkgbuild.com > > should be ready to generate signed packa

Re: [arch-dev-public] Finalizing the package signing process

2011-10-30 Thread Giovanni Scafora
Il 30/10/2011 18:56, Daniel Isenmann ha scritto: I'm building my packages exclusive on pkgbuild.com and there I can't sign packages. If we do the switch in dbscripts then pkgbuild.com should be ready to generate signed packages. As far as I know it isn't possible yet, am I right? You can build

Re: [arch-dev-public] Finalizing the package signing process

2011-10-30 Thread Daniel Isenmann
On Sun, 30 Oct 2011 14:12:20 +0100 Pierre Schmitz wrote: > Hi all, > > it's about time to finalize our signing policy to get all our packages > properly signed as soon as possible. Note that this is just about > signing the package itself. How we will manage our keyring and sign > that one using

Re: [arch-dev-public] Finalizing the package signing process

2011-10-30 Thread Tobias Powalowski
Am 30.10.2011 14:12, schrieb Pierre Schmitz: > Hi all, > > it's about time to finalize our signing policy to get all our packages > properly signed as soon as possible. Note that this is just about > signing the package itself. How we will manage our keyring and sign that > one using master keys i

Re: [arch-dev-public] Finalizing the package signing process

2011-10-30 Thread Andrea Scarpino
On 30 October 2011 14:14, Thomas Bächler wrote: > Am 30.10.2011 14:12, schrieb Pierre Schmitz: >> To speed things up I'd like to let dbscripts enforce signed packages. >> This means that from now on no new packages can be uploaded that don't >> have a signature. > > +1 > >> We may give the TU a ew

Re: [arch-dev-public] Finalizing the package signing process

2011-10-30 Thread Florian Pritz
On 30.10.2011 14:12, Pierre Schmitz wrote: > If you just agree with all this send a +1. +1 PS: we should get a voting system -- Florian Pritz signature.asc Description: OpenPGP digital signature

Re: [arch-dev-public] Finalizing the package signing process

2011-10-30 Thread Dave Reisner
On Sun, Oct 30, 2011 at 02:12:20PM +0100, Pierre Schmitz wrote: > Hi all, > > it's about time to finalize our signing policy to get all our packages > properly signed as soon as possible. Note that this is just about > signing the package itself. How we will manage our keyring and sign that > one

Re: [arch-dev-public] Finalizing the package signing process

2011-10-30 Thread Ronald van Haren
On Sun, Oct 30, 2011 at 2:31 PM, Giovanni Scafora wrote: > Il 30/10/2011 14:12, Pierre Schmitz ha scritto: >> >> Hi all, >> >> it's about time to finalize our signing policy to get all our packages >> properly signed as soon as possible. Note that this is just about >> signing the package itself.

Re: [arch-dev-public] Finalizing the package signing process

2011-10-30 Thread Giovanni Scafora
Il 30/10/2011 14:12, Pierre Schmitz ha scritto: Hi all, it's about time to finalize our signing policy to get all our packages properly signed as soon as possible. Note that this is just about signing the package itself. How we will manage our keyring and sign that one using master keys is a dif

Re: [arch-dev-public] Finalizing the package signing process

2011-10-30 Thread Tom Gundersen
On Sunday 30 October 2011 14:12:20 Pierre Schmitz wrote: > Hi all, > > it's about time to finalize our signing policy to get all our packages > properly signed as soon as possible. Note that this is just about > signing the package itself. How we will manage our keyring and sign that > one using m

Re: [arch-dev-public] Finalizing the package signing process

2011-10-30 Thread Guillaume ALAUX
On 30 October 2011 14:22, Allan McRae wrote: > On 30/10/11 23:12, Pierre Schmitz wrote: >> >> If you just agree with all this send a +1. > > +1 > Sounds good. -- Guillaume

Re: [arch-dev-public] Finalizing the package signing process

2011-10-30 Thread Thomas Bächler
Am 30.10.2011 14:12, schrieb Pierre Schmitz: > To speed things up I'd like to let dbscripts enforce signed packages. > This means that from now on no new packages can be uploaded that don't > have a signature. +1 > We may give the TU a ew days mroe time as this will be > new to them. -1 - they

Re: [arch-dev-public] Finalizing the package signing process

2011-10-30 Thread Allan McRae
On 30/10/11 23:12, Pierre Schmitz wrote: If you just agree with all this send a +1. +1

[arch-dev-public] Finalizing the package signing process

2011-10-30 Thread Pierre Schmitz
Hi all, it's about time to finalize our signing policy to get all our packages properly signed as soon as possible. Note that this is just about signing the package itself. How we will manage our keyring and sign that one using master keys is a different story. At first please have a look at http