| 1 |
Why not take package security one step deeper to ensure the validity of every ebuild and source-tree? |
| 2 |
|
| 3 |
Instead of relying upon a master hash of the compressed package, create a hash for each source file, documentation, makefile, etc., and as part of the emerge process, the application validates the compressed hash, then looks at each decompressed file and compares the hash value of it against a master repository. |
| 4 |
|
| 5 |
Once everything checks out, we then guarantee that the compressed package and all related source files are true to the source as it was created since the master hash tables are contained in the master repository instead of within the compressed file (which can be altered). |
| 6 |
|
| 7 |
Just an idea, and if I am way off, let me know. |
| 8 |
|
| 9 |
Brian... |
Archives