Re: [Duplicity-talk] Manifest stores SHA1 hash of files, checked before restore?

[edgar . soldin]

On 14.07.2011 15:03, Kenneth Loafman wrote:
>>     why don't we simply show the password and circumvent the need for 
>> verification?
>> 
>>    also we should have a check if gpg receiver[0] == sign_key[0], so the 
>> pass is not asked two times for the same key on simple one key only setups.
> 
> 
> Showing the password is a security risk, but maybe we could put in an option.

on the other hand users can do 
PASSPHRASE='whoa_secret' duplicity ...
which would of course land in the users history (which is bad).

if you think the retype is necessary, let's leave it, people will complain if 
it really bothers. duplicity's target still is the cron runabilility.

> 
> Checking for the same keys would be a good enhancement.

will try to provide a branch for that, also the SIGN_PASSPHRASE change should 
get documented in manpage.

ede/duply.net