sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors

From: "Sergey A. Lipnevich" <sergey AT optimaltec.com>
To: sm-discuss AT lists.ibiblio.org
Subject: Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors
Date: Wed, 31 Aug 2005 19:09:14 -0400

On Wed, 2005-08-31 at 16:00 -0700, Andrew wrote:
> > If the vendor has a compromised key and is not doing anything about it,
> > then removing their signature and replacing it with a good hash may be a
> > solution.
>
> Or signing the tarball ourselves...

No doubt.

Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors , (continued)
- Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors, Seth Alan Woolley, 08/31/2005
  - Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors, Sergey A. Lipnevich, 08/31/2005
    - Re: [SM-Discuss] Threat profile analysis for spackages not signed by authors, Seth Alan Woolley, 08/31/2005