[Haskell-cafe] Ticking time bomb

[Vincent Hanquez]

On 01/30/2013 07:27 PM, Edward Z. Yang wrote:
> https://status.heroku.com/incidents/489
>
> Unsigned Hackage packages are a ticking time bomb.
>
I agree this is terrible, I've started working on this, but this is 
quite a bit of work and other priorities always pop up.

https://github.com/vincenthz/cabal
https://github.com/vincenthz/cabal-signature

My current implementation generate a manifest during sdist'ing in cabal, 
and have cabal-signature called by cabal on the manifest to create a 
manifest.sign.

The main issue i'm facing is how to create a Web of Trust for doing all 
the public verification bits.

-- 
Vincent