Re: mtn & GPG signatures [Was: [Monotone-devel] WARNING: ~/.monotone/keys CONSIDERED HARMFUL]

2008-10-23 Thread Brian May
Lapo Luchini wrote: (yes I know, it's not easy to check it's the *same* mtn key that's in your DB as "[EMAIL PROTECTED]" and you received using netsync… and that part of the UI must be improved to show some unique hash at least when keyids It would be most useful if the UI would display the ke

Re: mtn & GPG signatures [Was: [Monotone-devel] WARNING: ~/.monotone/keys CONSIDERED HARMFUL]

2008-10-21 Thread Daniel Carrera
Lapo Luchini wrote: But I said "sign your public key", not "sign your keyid" ;-) Signing the key material, not the name, as in: From the FAQ: In the rare case where you do know that the person whose passport says "Jane Doe" is a hotshot coder who should definitely have commit access, you ca

mtn & GPG signatures [Was: [Monotone-devel] WARNING: ~/.monotone/keys CONSIDERED HARMFUL]

2008-10-21 Thread Lapo Luchini
Brian May wrote: > Lapo Luchini wrote: >> 1. GPG-sign your monotone public key: this way people that trust your >> GPG key know that they can trust your monotone signatures (if they trust >> monotone itself, that is) >> > You still need some way of being able to tell that the revision was > sign