On Dec 5, 2007, at 7:46 PM, Rui Miguel Silva Seabra wrote:
quoted text
>
> I don't see what is the problem with blessing a fingerprint of the
> binaries with a PKI signature, which would mean that *these* are the
> binaries the devs intended to release.

Who would sign the binaries?
Would each package maintainer sign his own packages?
Does Theo have to sign each package?
I don't see a problem in having signatures for software but I do see
problems in creating and maintaining an infrastructure for these  
signatures.
And what would you gain?
What guarantees would these signatures give you?
You can verify package consistency with md5 sums.

If you are paranoid, why would you trust the devs? You would just  
compile
the software yourself. But only after reading each line of code of  
course.


Floor Terra