Re: [Devil-linux-develop] Re: signed source packages

[Friedrich L. <fl...@fl...>]

Bruce Smith wrote on 12.01.2004 20:29 MET:
> 
> How do we protect the lfssystem...tar file itself?
> Someone could cause us real problems by changing that file.

The same md5sum file signed. Then on the homepage we put up
the info how to download the public keys that correspond to the
signing keys. The keys can also be checked-in into CVS I think.
So then a very curiouse person will get the public key from cvs
and from a pgp keyserver to be sure to have the correct one.


-- 
MfG / Regards
Friedrich Lobenstock
____________________________________________________________________
Friedrich Lobenstock                       Linux Services Lobenstock
URL: http://www.lsl.at/                         Email: fl...@fl...
____________________________________________________________________