Public SourceMage Discussion List

[Andrew <afrayedknot AT thefrayedknot.armory.com>]

> 
> Vendor signing is great but personally I would extra add our hash.
> What about if for example home page of  wget is cracked, wget author's 
> key is stolen, new tarball with "rm -rf /*" is created and signed?
> 

If you put the vendor's signature in the spell that can't happen.
Yes thats different than current suggestions for vendor signing, but
has come up elsewhere. No need to have extra guru supplied verification.

-Andrew

-- 
__________________________________________________________________________
|Andrew D. Stitt                           | astitt at sourcemage.org    |
|irc: afrayedknot                          | afrayedknot at t.armory.com |
|aim: thefrayedknot or iteratorplusplus    | acedit at armory.com        |
|Sorcery Team Lead                         | ftp://t.armory.com/         |
--------------------------------------------------------------------------