Re: [Duplicity-talk] recovering

[Peter Schuller]

> However - why would one want ot silently supress this?

Ok, following up on myself, my interpretation is that the intent is to simply 
completely ignore anything that could not be successfully verified to be 
trusted, in the case of a signed manifest, and the "bug" is more of the 
nature of that particular action not being caught properly in the upper 
layers.

If this is the case:

* Is it not a false sense of security, since an attacker might as well replace 
the manifest with one that is not signed at all, thus bypassing the check 
anyway?

* Is the intet that duplicity restores should "just work" as long as the key 
in question is in the user's keyring? What is the intented passphrase 
handling in these cases - should the user be using an agent?

I'd like to submit a patch to clarify some things in the manpage, when I 
understand it myself to begin with. Anyone have input?

-- 
/ Peter Schuller

PGP userID: 0xE9758B7D or 'Peter Schuller <address@hidden>'
Key retrieval: Send an E-Mail to address@hidden
E-Mail: address@hidden Web: http://www.scode.org

signature.asc
Description: This is a digitally signed message part.