From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 5397 invoked from network); 12 Nov 2004 16:32:02 +0000 Received: from smtp.gentoo.org (156.56.111.197) by lists.gentoo.org with AES256-SHA encrypted SMTP; 12 Nov 2004 16:32:02 +0000 Received: from lists.gentoo.org ([156.56.111.196] helo=parrot.gentoo.org) by smtp.gentoo.org with esmtp (Exim 4.41) id 1CSeLC-0003lf-Jd for arch-gentoo-security@lists.gentoo.org; Fri, 12 Nov 2004 16:32:02 +0000 Received: (qmail 14963 invoked by uid 89); 12 Nov 2004 16:31:41 +0000 Mailing-List: contact gentoo-security-help@gentoo.org; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-security@gentoo.org Received: (qmail 4842 invoked from network); 12 Nov 2004 16:31:40 +0000 Date: Fri, 12 Nov 2004 11:31:40 -0500 From: Chris Frey To: gentoo-security@lists.gentoo.org Message-ID: <20041112113140.B18832@netdirect.ca> References: <20041112104711.A15617@netdirect.ca> <20041112162749.GB2441@mail.lieber.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5.1i In-Reply-To: <20041112162749.GB2441@mail.lieber.org>; from klieber@gentoo.org on Fri, Nov 12, 2004 at 04:27:49PM +0000 Subject: [gentoo-security] Re: installing the patch X-Archives-Salt: 91519236-45af-4ad6-9729-b8fcec70e1d7 X-Archives-Hash: 4eaa241efc70d2706a2b15ea90b2258e Whoohoo! :-) Thanks Kurt, - Chris On Fri, Nov 12, 2004 at 04:27:49PM +0000, Kurt Lieber wrote: > On Fri, Nov 12, 2004 at 10:47:11AM -0500 or thereabouts, Chris Frey wrote: > > I'm just curious if there is any plan to install Peter's patch. I haven't > > heard any explanations of why it won't work, since it only signs a checksum > > of the tarball, so shouldn't have any load or bandwidth drawbacks. > > This has already been discussed on the list. I made the original > suggestion regarding singning snapshots in the first place, so of course > I'm willing to implement the patch. > > I have the script on the main server right now -- it's just not in > production yet. I've got one or two small issues to iron out and then > it will be rolled out. At this point, nobody has written code to modify > emerge-webrsync to support the signed snapshots. Until that happens, > checking will be left to the user to perform manually. > > And, to answer the next question: Real Soon Now. > > --kurt -- gentoo-security@gentoo.org mailing list