Public SourceMage Discussion List

[Seth Alan Woolley <seth AT positivism.org>]

On Wed, Aug 31, 2005 at 06:51:56PM +0200, Ladislav Hagara wrote:
> > The beauty of hashes is that they don't need any extra support in 
> > addition to
> > what's in sorcery now.
> 
> 
> Moreover, if there is some integrity problem, even users can discuss 
> about their hashes, they can easily compare them.
> In p4 reviews I see ascii changes, not only "binary file was changed".

This is possible in PGP as well, not directly through gpg, they 
suggested pgpdump could be modified to do something similar.

> 
> Vendor signing is great but personally I would extra add our hash.
> What about if for example home page of  wget is cracked, wget author's 
> key is stolen, new tarball with "rm -rf /*" is created and signed?

Yeah, as said, we just include the sig locally.

-- 
Seth Alan Woolley [seth at positivism.org], SPAM/UCE is unauthorized
Quality Assurance Team Leader & Security Team: Source Mage GNU/linux
Linux so advanced, it may as well be magic http://www.sourcemage.org
Secretary Pacific Green Party of Oregon http://www.pacificgreens.org
Key id FDCEE733 = 5302 B414 64C4 6112 3454  E082 99F0 69DC FDCE E733

Attachment: pgpDugl8UA_68.pgp
Description: PGP signature