Re: Lack of detached signatures

From: Michael Witten <mfwitten@gmail.com>
Date: Sep 28, 2011, 16:55 UTC
Message-ID: <CAMOZ1BtJ5qvJt_a5vP9ddNUtZQfbWgKyh5ePNve4kqLnaEaZ4A@mail.gmail.com>
In-Reply-To: <7v1uv01uqm.fsf@alter.siamese.dyndns.org>

On Wed, Sep 28, 2011 at 16:45, Junio C Hamano <gitster@pobox.com> wrote:

Show 6 quoted lines

> The world is not so blank-and-white. Trust is ultimately among humans. If
> this message is not from the real Junio, don't you think you will hear
> something like "No, that c6ba05... is forgery, please don't use it!" from
> him, when he finds this message on the Git mailing list?  If he does not
> exercise diligence to even do that much, does he deserve your trust in the
> first place?

You are parroting Linus's drivel.

If we get to the point where we need the real Junio yelling:

  DO NOT USE IT!

then things went too far long before. In that case, my trust in you as the maintainer would also take a hit; I expect you to use the available technology to avoid such a situation.

Not everybody manages to read every [real] message of yours, so we need to provide people with ways to check for themselves that the sources that they have *locally* already are sound.