Public SourceMage Discussion List

[Jaka Kranjc <smgl AT lynxlynx.info>]

> One thing I would improve is our source tarballs verifying. For source
> tarballs signed by vendors keys I would add second level of veryfying,
> our own signature or hash or push wendors sign files into grimoire. We
> have sources signed by people we really don't know, we don't how their
> protect their private key. If some bad guy gains control over vendor www
> of ftp server and publishes sources with "rm -rf /*" for example in
> configure and signed it with stolen vendor key, we have no chance to
> catch it, really no fun on production servers.
This is already possible - a spell can have many verification levels (eg. 
SOURCE_HASH4). For details, see the second half of the introductory commen in 
sorcery's libunpack.

LP
-- 
We cannot command nature except by obeying her.  --Sir Francis Bacon
Have a sourcerous day! www.sourcemage.org