Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Basesystem Cache files on Mirror

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: David Kowis <dkowis AT shlrm.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Basesystem Cache files on Mirror
  • Date: Thu, 28 Apr 2005 16:23:59 -0500

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Ondra Tomecka wrote:
>
> And don't forget that this has potential for a huge security hole, when
> some malicious user contributes tarball with modified binary. How are we
> supposed to detect such a thing, or prevent it at all? Not that I think
> such tarball cache is bad idea, it would save me quite a lot of time
> sometimes, but still this security concern is a big one.

Perhaps, since there's stuff in sorcery for GPG verification, we could
use gpg to verify the tarballs. If the QA Team is going to generate them
then they could sign the tarballs and put the signature and the cache on
the download site.


- --
One login to rule them all, one login to find them. One login to bring
them all, and in the web bind them.
http://shlrm.org
http://www.zoominfo.com/DavidKowis
http://www.flickr.com/photos/davidkowis
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (MingW32)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFCcVRvtgErhgxHMHsRAl5RAJ0YI6hTJk/NRllWCuhEHU8WqhdRKgCcDIkm
bRtf0FqydKYpmWU/MHL3Ttc=
=0I5l
-----END PGP SIGNATURE-----




Archive powered by MHonArc 2.6.24.

Top of Page