Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors
  • Date: Wed, 31 Aug 2005 18:43:24 -0400

On Wed, 2005-08-31 at 09:51 -0700, Andrew wrote:
> >
> > Vendor signing is great but personally I would extra add our hash.
> > What about if for example home page of wget is cracked, wget author's
> > key is stolen, new tarball with "rm -rf /*" is created and signed?
> >
>
> If you put the vendor's signature in the spell that can't happen.
> Yes thats different than current suggestions for vendor signing, but
> has come up elsewhere. No need to have extra guru supplied verification.

If the vendor has a compromised key and is not doing anything about it,
then removing their signature and replacing it with a good hash may be a
solution.





Archive powered by MHonArc 2.6.24.

Top of Page