1 |
Ervin Németh writes: |
2 |
|
3 |
> How about this: the developers have to sign the files |
4 |
> they upload, but do this before they upload them? |
5 |
|
6 |
I believe that it is practically unfeasible to verify the |
7 |
signatures of dozens of people which are spread over dozens |
8 |
of different directories. By building the signatures into |
9 |
Portage only, you require the user to have a working Gentoo |
10 |
system before he can verify he has a _real_ Gentoo system. |
11 |
When Portage runs the checks, it is too late. You have to be |
12 |
able to verify the authenticity of your downloaded files |
13 |
before you start the first executable you've downloaded. |
14 |
That's why I am in favor of a simple, ordinary text file |
15 |
which is GPG-signed and contains ordinary hashes. |
16 |
|
17 |
Peter |
18 |
|
19 |
|
20 |
-- |
21 |
gentoo-security@g.o mailing list |