Public SourceMage Discussion List

[David Kowis <dkowis AT shlrm.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Ondra Tomecka wrote:
> 
> And don't forget that this has potential for a huge security hole, when 
> some malicious user contributes tarball with modified binary. How are we 
> supposed to detect such a thing, or prevent it at all? Not that I think 
> such tarball cache is bad idea, it would save me quite a lot of time 
> sometimes, but still this security concern is a big one.

Perhaps, since there's stuff in sorcery for GPG verification, we could
use gpg to verify the tarballs. If the QA Team is going to generate them
then they could sign the tarballs and put the signature and the cache on
the download site.


- --
One login to rule them all, one login to find them. One login to bring
them all, and in the web bind them.
http://shlrm.org
http://www.zoominfo.com/DavidKowis
http://www.flickr.com/photos/davidkowis
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFCcVRvtgErhgxHMHsRAl5RAJ0YI6hTJk/NRllWCuhEHU8WqhdRKgCcDIkm
bRtf0FqydKYpmWU/MHL3Ttc=
=0I5l
-----END PGP SIGNATURE-----