Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Grimoire Lead vote for 2010

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Jaka Kranjc <smgl AT lynxlynx.info>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Grimoire Lead vote for 2010
  • Date: Thu, 8 Apr 2010 10:00:39 +0200

> One thing I would improve is our source tarballs verifying. For source
> tarballs signed by vendors keys I would add second level of veryfying,
> our own signature or hash or push wendors sign files into grimoire. We
> have sources signed by people we really don't know, we don't how their
> protect their private key. If some bad guy gains control over vendor www
> of ftp server and publishes sources with "rm -rf /*" for example in
> configure and signed it with stolen vendor key, we have no chance to
> catch it, really no fun on production servers.
This is already possible - a spell can have many verification levels (eg.
SOURCE_HASH4). For details, see the second half of the introductory commen in
sorcery's libunpack.

LP
--
We cannot command nature except by obeying her. --Sir Francis Bacon
Have a sourcerous day! www.sourcemage.org




Archive powered by MHonArc 2.6.24.

Top of Page