X-Recipient: archive-cygwin AT delorie DOT com X-SWARE-Spam-Status: No, hits=-1.9 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_NONE,RCVD_IN_HOSTKARMA_YE X-Spam-Check-By: sourceware.org X-Mail-Handler: MailHop Outbound by DynDNS X-Report-Abuse-To: abuse AT dyndns DOT com (see http://www.dyndns.com/services/mailhop/outbound_abuse.html for abuse reporting information) X-MHO-User: U2FsdGVkX18Tf+0KcbnIVnw6HxZk8saE Date: Tue, 12 Jun 2012 09:16:08 -0400 From: Christopher Faylor To: cygwin AT cygwin DOT com Subject: Re: Trusted Software Vendor Message-ID: <20120612131608.GA18920@ednor.casa.cgf.cx> Reply-To: cygwin AT cygwin DOT com Mail-Followup-To: cygwin AT cygwin DOT com References: <20120608184641 DOT GA13771 AT ednor DOT casa DOT cgf DOT cx> <4FD32DC5 DOT 10703 AT gmail DOT com> <20120609155700 DOT GA21988 AT ednor DOT casa DOT cgf DOT cx> <4FD73CC9 DOT 3070501 AT etr-usa DOT com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4FD73CC9.3070501@etr-usa.com> User-Agent: Mutt/1.5.20 (2009-06-14) Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner AT cygwin DOT com Mail-Followup-To: cygwin AT cygwin DOT com Delivered-To: mailing list cygwin AT cygwin DOT com On Tue, Jun 12, 2012 at 06:57:45AM -0600, Warren Young wrote: >On 6/9/2012 9:57 AM, Christopher Faylor wrote: >>and I'm really not willing to burden cygwin.com with the cycles >>necessary to unpack tarballs at cygwin.com to sign them. > >Based on the traffic I see to cygwin-apps, my sense is that this would >amount to single-digit CPU-minutes per day, once you get through the >initial conversion. That can be nice'd to the point that it takes a >month; this doesn't have to be a Big Bang conversion. > >I think a much bigger problem is getting a Linux toolchain set up on >the main package repo server that can sign these executables. My >Google-fu says the GNU tools have no idea how to do this today. > >Then someone has to spend at least a few hours writing and testing the >script to do all this. It might take a person-day. If you are working under the misapprehension that I don't understand what's required to get this to work, I can assure you that you're wrong. >Red Hat might not have to buy a code signing cert for this. They might >already have one that will work: http://goo.gl/5Hm3C The Cygwin project is not Red Hat. It wouldn't be "Red Hat" buying anything. cgf -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple