Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors
  • Date: Wed, 31 Aug 2005 19:08:07 -0400

On Wed, 2005-08-31 at 15:59 -0700, Andrew wrote:
> There is no keyserver, guru signing keys are not published to any
> keyserver unless the guru wants to, but theres no point to it, the keys
> are taken from the gurus.gpg keyring included in the grimoire.

Well then it's exactly the same as hash values :-), in that until the
grimoire (or keyring) is downloaded, nothing can be checked. If as you
suggest a method exists to alert the user that there's an updated
signature, hashes could be part of this method.





Archive powered by MHonArc 2.6.24.

Top of Page