From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 6146 invoked by uid 1002); 22 Nov 2003 02:08:19 -0000 Mailing-List: contact gentoo-dev-help@gentoo.org; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-dev@gentoo.org Received: (qmail 19501 invoked from network); 22 Nov 2003 02:08:19 -0000 From: Yi Qiang Reply-To: khai@turbonet.com To: gentoo-dev@gentoo.org Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-DQURnZ1TNLIIY+zWS3n5" Message-Id: <1069466950.8702.4.camel@veritas> Mime-Version: 1.0 X-Mailer: Ximian Evolution 1.4.5 Date: Fri, 21 Nov 2003 18:09:11 -0800 Subject: [gentoo-dev] GPG Signed packages X-Archives-Salt: ffaa5c24-2fa3-4ad6-ad4a-3604411ba758 X-Archives-Hash: 8f27acac281e25235f622e1e29449d45 --=-DQURnZ1TNLIIY+zWS3n5 Content-Type: text/plain Content-Transfer-Encoding: quoted-printable I think this has been brought up many times before, but as most of us know, many of the debian servers have been compromised recently. This has reinstated fear into many people about how "trustful" our distfile repositories really are. If indeed one is compromised it would be too easy for someone to slip a backdoor into a package, especially since I and a lot of other gentoo users simply ignore md5 checksums. If a digest fails we simply ebuild foo.ebuild digest it again. I think an option should be made that would allow failing packages if gpg fails. (I think Redhat does something like this) This of course is not a fool proof way, but a big improvement over what is currently done to ensure package integrity.=20 Yi --=-DQURnZ1TNLIIY+zWS3n5 Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iD8DBQA/vsVFi3HEpMf3m5cRAqz/AJ9NZfhpjSBMLQB9s1pFCnTDaxEvsgCffEwE srgoUkqwa/rvO4IGykVsLzg= =gbBE -----END PGP SIGNATURE----- --=-DQURnZ1TNLIIY+zWS3n5--