RE: PGP signatures for packages?

2002-05-18 Thread Robert Collins
> -Original Message- > From: Michael Young [mailto:[EMAIL PROTECTED]] > Sent: Saturday, May 18, 2002 1:35 PM > To: Robert Collins; [EMAIL PROTECTED] > Subject: Re: PGP signatures for packages? > > > > And adding GPG as a package should be easy. T

Re: PGP signatures for packages?

2002-05-18 Thread Lapo Luchini
> We need a cygwin build -- perhaps built using a cygwin-targetted cross > compiler on linux-host, but definitely not using a > native-mswindows(mingw) targetted cross compiler on any host platform. This ML message says it is not "so easy" to compile latest version for Cygwin: http://lists.gn

Re: PGP signatures for packages?

2002-05-17 Thread Charles Wilson
Michael Young wrote: >>And adding GPG as a package should be easy. There is already vounteer >>binary downloads 'out there'. You just need to merge tehir build recipe >>and patchs and the volunteer maintainer instructions. >> > > My understanding is that the official Windows binaries for GnuPG a

Re: PGP signatures for packages?

2002-05-17 Thread Michael Young
> And adding GPG as a package should be easy. There is already vounteer > binary downloads 'out there'. You just need to merge tehir build recipe > and patchs and the volunteer maintainer instructions. My understanding is that the official Windows binaries for GnuPG are built on Linux using a cro

RE: PGP signatures for packages?

2002-05-17 Thread Robert Collins
> -Original Message- > From: Michael Young [mailto:[EMAIL PROTECTED]] > Sent: Saturday, May 18, 2002 1:19 AM > Would you be willing to provide the binary over HTTPS? > It looks like Apache with mod_ssl is built for Cygwin. This one I have no input on. Well I can voice an opinion, an

Re: PGP signatures for packages?

2002-05-17 Thread Charles Wilson
Cliff Hones wrote: > [Etymology - moot is an old word meaning meeting place, typically > for an assembly or court.] > Hurrah for the Entmoot! --Chuck -- Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple Bug reporting: http://cygwin.com/bugs.html Documentation: h

Re: PGP signatures for packages?

2002-05-17 Thread Michael Young
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 >That's it. But without that I will not sign setup.exe. Just like I > > didn't compress it until UPX became a package :]. OK. I was hoping that you might treat this as a post-build distribution step, and might allow the use of non-Cygwin tools (much

RE: PGP signatures for packages?

2002-05-17 Thread Robert Collins
> -Original Message- > From: Cliff Hones [mailto:[EMAIL PROTECTED]] > Sent: Friday, May 17, 2002 5:28 PM > To: [EMAIL PROTECTED]; Robert Collins > Subject: Re: PGP signatures for packages? > > > Robert Collins <[EMAIL PROTECTED]> wrote: > > ... >

Re: PGP signatures for packages?

2002-05-17 Thread Cliff Hones
Robert Collins <[EMAIL PROTECTED]> wrote: > ... > Until that is done, conversation on this is moot. > ... 'moot' is one of those words which doesn't travel well. In UK English, it means "undecided" or "debatable", so a moot point is one which hasn't been settled, and is open to discussion. I bel

RE: PGP signatures for packages?

2002-05-16 Thread Robert Collins
> -Original Message- > From: Michael Young [mailto:[EMAIL PROTECTED]] > Sent: Friday, May 17, 2002 3:27 PM > > So, how would the Cygwin team feel about GPG-signing just these > two files? I'm the setup.exe maintainer. Here's what I need before I will sign setup.exe. (More on setup.in

Re: PGP signatures for packages?

2002-05-16 Thread Michael Young
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 From: "Charles Wilson" <[EMAIL PROTECTED]> > Currently, setup.ini contains md5 hashes for each tarball. The released > version of setup.exe successfully ignores those md5's, but the HEAD will Doh! I should have noticed that. That's great! If the

RE: PGP signatures for packages?

2002-05-16 Thread Robert Collins
> -Original Message- > From: Christopher Faylor [mailto:[EMAIL PROTECTED]] > Sent: Friday, May 17, 2002 1:43 PM > >I saw a note back in December > >(http://sources.redhat.com/ml/cygwin/2001-12/msg00950.html) > >that touched on this, but I couldn't find any followup. Did this > >withe

Re: PGP signatures for packages?

2002-05-16 Thread Charles Wilson
Michael Young wrote: > Are signatures available for the setup program, or for the packages it > downloads? > RPM uses GPG signatures, but I can't find anything comparable for the Cygwin > binaries. Even just a list of hashes would be worthwhile (ideally vended from > a secure Cygwin/Redhat web pa

Re: PGP signatures for packages?

2002-05-16 Thread Christopher Faylor
On Thu, May 16, 2002 at 11:26:30PM -0400, Michael Young wrote: >Are signatures available for the setup program, or for the packages it >downloads? >RPM uses GPG signatures, but I can't find anything comparable for the Cygwin >binaries. Even just a list of hashes would be worthwhile (ideally vende

PGP signatures for packages?

2002-05-16 Thread Michael Young
Are signatures available for the setup program, or for the packages it downloads? RPM uses GPG signatures, but I can't find anything comparable for the Cygwin binaries. Even just a list of hashes would be worthwhile (ideally vended from a secure Cygwin/Redhat web page) to verify that a mirror (or