Re: [gentoo-security] Re: Re: Is anybody else worried about this?

[Rui Covelo <rpfc@mega.ist.utl.pt>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

| So is the solution.  It was posted a few messages back.  We just need some
| admin to drop a find script on the main server and setup the required
| keys.  Once the signatures are there, anyone can write the userland script
| to do the verification, but until then, there's no point to write it since
| the server implementation is not known.
|
| - Chris

Read Peter's message moments after sending mine.

I like Peter's idea. But the question is still, where to keep the public
key and private key. Yes, maybe it's better to trust the developers than
any mirror admin.

Adding to what Peter said, what about having the public and private key
changed periodicaly (developers come and go, keys should come and go
too) and have the portage download automaticaly the public key and
revokation certificates when needed from a single server? Ex: www.gentoo.org




-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.6 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBjlWbfLPhlaxNQk0RAqfZAJsGaLid/8BzfXhQVbsNlLDKgfaUbQCggsW7
kc2rYAq3W0CdOCTgDYcQ0jQ=
=GziW
-----END PGP SIGNATURE-----

--
gentoo-security@gentoo.org mailing list