X-Recipient:	archive-cygwin AT delorie DOT com
X-SWARE-Spam-Status:	No, hits=-1.9 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_NONE,RCVD_IN_HOSTKARMA_YE
X-Spam-Check-By:	sourceware.org
X-Mail-Handler:	MailHop Outbound by DynDNS
X-Report-Abuse-To:	abuse AT dyndns DOT com (see http://www.dyndns.com/services/mailhop/outbound_abuse.html for abuse reporting information)
X-MHO-User:	U2FsdGVkX18Tf+0KcbnIVnw6HxZk8saE
Date:	Tue, 12 Jun 2012 09:16:08 -0400
From:	Christopher Faylor <cgf-use-the-mailinglist-please AT cygwin DOT com>
To:	cygwin AT cygwin DOT com
Subject:	Re: Trusted Software Vendor
Message-ID:	<20120612131608.GA18920@ednor.casa.cgf.cx>
Reply-To:	cygwin AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
References:	<!&!AAAAAAAAAAAYAAAAAAAAAH3PqnIBVHtCiVMVjN0ExZLigAAAEAAAAJXIkaLIcH5Pn+g+gRSa2KoBAAAAAA==@expertise.cl> <20120608184641 DOT GA13771 AT ednor DOT casa DOT cgf DOT cx> <4FD32DC5 DOT 10703 AT gmail DOT com> <20120609155700 DOT GA21988 AT ednor DOT casa DOT cgf DOT cx> <4FD73CC9 DOT 3070501 AT etr-usa DOT com>
MIME-Version:	1.0
In-Reply-To:	<4FD73CC9.3070501@etr-usa.com>
User-Agent:	Mutt/1.5.20 (2009-06-14)
Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id:	<cygwin.cygwin.com>
List-Unsubscribe:	<mailto:cygwin-unsubscribe-archive-cygwin=delorie DOT com AT cygwin DOT com>
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com

On Tue, Jun 12, 2012 at 06:57:45AM -0600, Warren Young wrote:
>On 6/9/2012 9:57 AM, Christopher Faylor wrote:
>>and I'm really not willing to burden cygwin.com with the cycles
>>necessary to unpack tarballs at cygwin.com to sign them.
>
>Based on the traffic I see to cygwin-apps, my sense is that this would
>amount to single-digit CPU-minutes per day, once you get through the
>initial conversion.  That can be nice'd to the point that it takes a
>month; this doesn't have to be a Big Bang conversion.
>
>I think a much bigger problem is getting a Linux toolchain set up on
>the main package repo server that can sign these executables.  My
>Google-fu says the GNU tools have no idea how to do this today.
>
>Then someone has to spend at least a few hours writing and testing the
>script to do all this.  It might take a person-day.

If you are working under the misapprehension that I don't understand
what's required to get this to work, I can assure you that you're wrong.

>Red Hat might not have to buy a code signing cert for this.  They might 
>already have one that will work: http://goo.gl/5Hm3C

The Cygwin project is not Red Hat.  It wouldn't be "Red Hat" buying
anything.

cgf

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple

- Raw text -