Re: [Gnu-arch-users] tla--devo--1.2 has preliminary gpg stuff

[Tom Lord]

    > From: James Blackwell <address@hidden>

    > Is that by design? I would have expected that when I mirrored everyone's
    > archive, their signature would go with their patches to prove I haven't
    > tampered with anybody's work.

Frankly I haven't tested it yet but currently, I believe, mirrors will
be signed "anew" -- that is, the person creating the mirror gets to
sign the contents.

That is, believe it or not, the right behavior for what I anticipate
will be a moderately common situation, e.g., a project that holds a
multi-committer archive off of a project host, but then has just one
member with keys registered to that host who pushes a mirror to it.

Nevertheless, the other common case is where you want to copy
signatures while mirroring.  That isn't there yet, but will be quite
soon.

-t