Messages in this thread | | | Subject | Re: Should we automatically generate a module signing key at all? | From | David Woodhouse <> | Date | Tue, 19 May 2015 19:08:09 +0100 |
| |
On Tue, 2015-05-19 at 10:58 -0700, Andy Lutomirski wrote: > > Throwing away the key is outright impossible in some contexts. > > https://wiki.debian.org/ReproducibleBuilds
Are any of the benefits described at https://wiki.debian.org/ReproducibleBuilds/About *not* just as achievable with the method I suggested — where you throw away the key and just validate that your builds are identical *except* for the signatures... which you can reuse, since your builds were identical.
-- dwmw2
| |