Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Seth Alan Woolley <seth AT positivism.org>
  • To: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors
  • Date: Wed, 31 Aug 2005 16:12:55 -0700

On Wed, Aug 31, 2005 at 07:03:20PM -0400, Sergey A. Lipnevich wrote:
> On Wed, 2005-08-31 at 11:07 -0700, Seth Alan Woolley wrote:
> > They still do, hashsum isn't as portable as I would have liked, so I'm
> > going to add gpg -print-md and (new in 0.9.8) the higher hashes
> > supported in openssl as alternative pure hash calculators (sans
>
> "gpg --print-md" would be fine by me. It has explicit algorith
> selection, making it easy to integrate into current SOURCE_HASH. I don't
> know if openssl has any benefit over it.

if gnupg isn't installed but openssl is -- having a diversity of
implementations also can help us not be reliant on one program. One day
gnupg might be broken, but openssl might work on a rare arch, and vice
versa. Having the option to use either keeps us in the safety margin.

Since you're in the energy industry, you should be aware, for example,
that on boilers and many other mechanical systems, there are at least
two safeties on every regulated value (in each direction it is
regulated).

This is just a backup safety device in my mind.

>
> > asymmetric encryption) if we go ahead with your SOURCE_HASH.
>
> It's not mine, and it never was.

I'll keep it :)

--
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Quality Assurance Team Leader & Security Team: Source Mage GNU/linux
Linux so advanced, it may as well be magic http://www.sourcemage.org
Secretary Pacific Green Party of Oregon http://www.pacificgreens.org
Key id FDCEE733 = 5302 B414 64C4 6112 3454 E082 99F0 69DC FDCE E733

Attachment: pgpFjLQlcUYWZ.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page