Security bugs are reported here via bugzilla

["Sergey A. Lipnevich" <sergey AT optimaltec.com>]

I think a spell is the lowest level at which it makes sense to provide 
cryptographic protection. If part of the spell is compromised, the whole 
spell is compromised. OTOH, if one spell is compromised, entire grimoire 
with all other spells, as well as sorcery, is not.

Hamish Greig wrote:

> Hmm Sounds rather involved Seth?
>
> If the following is possible it might be simpler?
> Perforce and cvs only allow access from registered/ authorised users so we 
> maintain development in that environment. For distribution of the grimoire we 
> have two options.
> 1)  download a signed tarball for stable, test, devel. can default to this if 
> current grimoire is more then 2weeks (example only) old.
> 2) Serve a signed {stable/test/devel } grimoire tree, where all files are 
> signed (detached) and the rsync process is piped through gpg allowing 
> verification before reintegration to local grimoire. Local unnecessary copies 
> of sig file can be deleted after the update. Gpg checks are made before 
> writing to local disk not after, so customisations can be made without 
> causing the update process to choke.
> The second option still allows minimal download pre update and gives good 
> security, without overheads and all that extra storage is not needed.
> Plus it also allows for a per file exclusion (if wanted) similar to the "add 
> options to configure" during cast.
> The only way that epoch matters is if it has been a long time since update and 
> then it will update the whole grimoire (still using signed tarballs,for 
> security) . For periods within that time frame it won't matter what version 
> of the file you have as rsync will just update it to the current regardless 
> of whether or not the file is 1MB or 0bytes.
> Please point out my faulty logic, poor knowledge of 1's and 0's or tell me how 
> attrocious my dress sense is ;-)
> All responses welcome.....
> Hamish
>
> Do You SMuGL!?
> Linux so advanced it may as well be magic!
> Everything you'll ever need on one web page
> http://www.sourcemage.org/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.2 (GNU/Linux)
>
> iD8DBQE+5ucM8fSufZR6424RAth1AJ9SsMGq1RFh0dy6ggpy7dtEIFEUuwCfauze
> FhUJkyrcwogjuUOak/Y28Qo=
> =E8VW
> -----END PGP SIGNATURE-----
>
> _______________________________________________
> SM-Grimoire mailing list
> SM-Grimoire AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-grimoire
>