[SM-Discuss] Threat profile analysis for spackages not signed by authors
Seth Alan Woolley
seth at positivism.org
Wed Aug 31 19:12:55 EDT 2005
On Wed, Aug 31, 2005 at 07:03:20PM -0400, Sergey A. Lipnevich wrote:
> On Wed, 2005-08-31 at 11:07 -0700, Seth Alan Woolley wrote:
> > They still do, hashsum isn't as portable as I would have liked, so I'm
> > going to add gpg -print-md and (new in 0.9.8) the higher hashes
> > supported in openssl as alternative pure hash calculators (sans
> "gpg --print-md" would be fine by me. It has explicit algorith
> selection, making it easy to integrate into current SOURCE_HASH. I don't
> know if openssl has any benefit over it.
if gnupg isn't installed but openssl is -- having a diversity of
implementations also can help us not be reliant on one program. One day
gnupg might be broken, but openssl might work on a rare arch, and vice
versa. Having the option to use either keeps us in the safety margin.
Since you're in the energy industry, you should be aware, for example,
that on boilers and many other mechanical systems, there are at least
two safeties on every regulated value (in each direction it is
This is just a backup safety device in my mind.
> > asymmetric encryption) if we go ahead with your SOURCE_HASH.
> It's not mine, and it never was.
I'll keep it :)
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Quality Assurance Team Leader & Security Team: Source Mage GNU/linux
Linux so advanced, it may as well be magic http://www.sourcemage.org
Secretary Pacific Green Party of Oregon http://www.pacificgreens.org
Key id FDCEE733 = 5302 B414 64C4 6112 3454 E082 99F0 69DC FDCE E733
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Size: 189 bytes
Desc: not available
Url : http://lists.ibiblio.org/pipermail/sm-discuss/attachments/20050831/d21fda9a/attachment.bin
More information about the SM-Discuss