From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on dcvr.yhbt.net X-Spam-Level: X-Spam-ASN: AS33070 50.56.128.0/17 X-Spam-Status: No, score=-0.2 required=5.0 tests=AWL shortcircuit=no autolearn=unavailable version=3.3.2 X-Original-To: archivist@yhbt.net Delivered-To: archivist@dcvr.yhbt.net Received: from rubyforge.org (50-56-192-79.static.cloud-ips.com [50.56.192.79]) by dcvr.yhbt.net (Postfix) with ESMTP id AAAEB44C001 for ; Mon, 11 Mar 2013 22:55:59 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by rubyforge.org (Postfix) with ESMTP id 7E3882E099; Mon, 11 Mar 2013 22:56:00 +0000 (UTC) X-Original-To: mongrel-unicorn@rubyforge.org Delivered-To: mongrel-unicorn@rubyforge.org Received: from dcvr.yhbt.net (dcvr.yhbt.net [64.71.152.64]) by rubyforge.org (Postfix) with ESMTP id 805FE2E099 for ; Mon, 11 Mar 2013 22:48:14 +0000 (UTC) Received: from localhost (dcvr.yhbt.net [127.0.0.1]) by dcvr.yhbt.net (Postfix) with ESMTP id 30F9844C001; Mon, 11 Mar 2013 22:48:12 +0000 (UTC) Date: Mon, 11 Mar 2013 22:48:12 +0000 From: Eric Wong To: unicorn list Subject: Re: Signing the gem with a PGP key Message-ID: <20130311224812.GA26407@dcvr.yhbt.net> References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) X-BeenThere: mongrel-unicorn@rubyforge.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: mongrel-unicorn-bounces@rubyforge.org Errors-To: mongrel-unicorn-bounces@rubyforge.org Hongli Lai wrote: > After the recent Rubygems.org hack it became clear that somethings > needs to be done about authenticating gems. One of the efforts that > was launched is http://www.rubygems-openpgp-ca.org/. We at Phusion > have just finished signing all our gems and repositories with our PGP > key, and our PGP key has been verified and signed by this CA. > > It would be great if Unicorn can participate as well by signing future > releases. If you already use GnuPG then the process is extremely > straightforward. Can we designate gems be signed by a trusted third party (e.g. you?) That's how Debian (and presumably other OS distros work). _Nobody_ should trust me. I have and maintain zero credibility. The only credibility any unicorn has is what its users give it. _______________________________________________ Unicorn mailing list - mongrel-unicorn@rubyforge.org http://rubyforge.org/mailman/listinfo/mongrel-unicorn Do not quote signatures (like this one) or top post when replying