[Devil-linux-develop] Re: signed source packages

[Friedrich L. <fl...@fl...>]

Bruce Smith wrote on 12.01.2004 17:49 MET:
>>>>>another questions, are there plans to sign the source packages ????
>>>>>only a litte but important thing :-)
>>>>
>>>>Maybe we should at least do md5sums automatically in the update script.
>>>>That should be enough for now I think.
>>>
>>>
>>>Good idea
>>
>>Already filed a feature request.
>>
>>I think the best way is that we create for eg. archive.tar.bz2
>>a file archive.tar.bz2.md5sum. This was we can easily automate
>>the task of checking every file while at the same time decoupling
>>it from one single ftp maintainer who would create on big md5sum
>>file for all files.
> 
> 
> While this is a great idea to ensure the downloads are good, it does
> nothing to prevent what happened at Debian.  If someone breaks into the
> FTP site, they can easily create a new md5sum file after they change the
> source code.  We really need some kind of a signed file to prevent
> that.  Or at least keep the md5sum files on a different server.

Than every developer who can upload files to the ftp server needs
to sign each md5sum file he uploads, right?.

That would mean GPG needs to be installed in the lfs system right
from the beginning. The kexring can't be in CVS either, so that
would mean at start a developer has to initialize the keyring with
all the GPG/PGP public certificates. It always get's more
complicated...

-- 
MfG / Regards
Friedrich Lobenstock
____________________________________________________________________
Friedrich Lobenstock                       Linux Services Lobenstock
URL: http://www.lsl.at/                         Email: fl...@fl...
____________________________________________________________________