[Monotone-devel] Re: BZ2 & signatures

[Lapo Luchini]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Nathaniel Smith wrote:
> On Mon, Jul 31, 2006 at 09:07:58PM +0200, Lapo Luchini wrote:
>> I wonder: why the sources are only available as .tar.gz?
>> Using .tar.bz2 they compress down to 3.5 MiB instead of 4.6 MiB.
> Tradition?  (Does it matter?)
Well, it's just smaller... and many source package forms that prefer
to include the "original package" itself (in order for it to be
verifiable by hash or signature with the one on the upstream server)
like cygwin packages would be smaller as well.
But no, it does not matter *that* much nowadays, I'm just a bit
paranoid ;-)
(my philosophy is: if you can do it smaller/better/more you should do it)
>> a detached GPG signature of the file.
> Laziness? :-)
>
> (Also, I'm the one that rolls releases these days, and I don't have a
> verifiable gpg key anyway...)
If you're interested in improving your key reachability I may suggest
exchanging signatures with Matt Zimmerman (and/or Cort Stratton and/or
Doug Barton or others), they live in Los Angeles and are willing to
meet people to exchange signatures, as implied by their presence on
BigLumber:
http://www.biglumber.com/x/web?sl=29

The three of them are connected to the SCC (strongly connected subset
of GPG signatures graph), with Matt the stronger of the three (a mean
distance of only 4 links from anyone else, a distance of 3 signatures
from me).

- --
Lapo Luchini
address@hidden (OpenPGP & X.509)
www.lapo.it (Jabber, ICQ, MSN)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.1 (Cygwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iQIcBAEBAgAGBQJEzutKAAoJELBiMTth2oCDRHIQAJqP3FZxFbJHjW5k2D3uGpw7
nkflf8ayQ9JQ/1eRvsclbDwW7kzA2m13k0YKNWCATcRsCQN8Fgv74o2eNI0Brbux
3lYqpoOEsMH1dVQLwV6EYdwHqcwTugAYKZQ8FRy2vwT+SK2W5miN2mIHlDO5lfbC
TF08QvaV0QNxg/VxgYDvYeeESnF2l3Vi3acRuwW40CJZnPJHOuZ3/NebUyrYGyg5
IlMSBzdFtF9Twxqi82E9bSMLhiqrVkSlobpidt3kdsqL0K83GGFAKjZGE4WL0fV8
cbkUIjA9pGi+agl12vb2uDY+idTxPMi0R7C2MOptCv0ZxI5XgRaPmz/qRD9HVDoo
nAeNpekueu7uaJdDtPJmHdPQlygo13tAybLe5C3oQ/z281SbsRPPv4FoG8faLmHo
dY7XpR+TdN64tsf/9bZXK/vuf30RiHAt+DMSrgBuiAQVoXLIKa2R67tTqosCRAQT
W0C7yHXHd+7AiW/CFM4Wcd35rOgBh/G8aZX5tVjhE3g12yZsbbfx3BU+ObhLp8DB
Di+maU4nnlV5Bslm440mfLonWTOI5Z9sdOTNJwd01+ZTy6iU1SSZonlN9XVI6hih
NLDm7tO2RbE5jAGp6wmskIZDDtJQOwq3pjOiQ/sDvqFIHl+p40L0+aacB7AF9+mF
ZhkZ1uJfVpNFDxzkuZS2
=acbn
-----END PGP SIGNATURE-----