Re: [gentoo-security] emerge sync

[Jesse Nelson]

nevermind think this topic has moved to the -dev ML.  

* Jesse Nelson (yoda@××××××.com) wrote:
> Date: Tue, 23 Mar 2004 15:10:30 -0800
> From: Jesse Nelson <yoda@××××××.com>
> To: gentoo-security@l.g.o
> User-Agent: Mutt/1.5.6i
> X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.63
> Subject: Re: [gentoo-security] emerge sync
>
> thought this stuff was discussed long ago bout adding sigs etc to build/dist files, and alot of devs pushed back. ?
> i dont recall but least 12-16 months ago ?
>
>
> are there solution proposals out now ? guess need a glep or somthing ?
>
>
> * Kurt Lieber (klieber@g.o) wrote:
> > Date: Tue, 23 Mar 2004 05:12:01 -0500
> > From: Kurt Lieber <klieber@g.o>
> > To: Koon <koon@××××××.net>
> > Cc: Jasmine CHUA <Jasmine.Chua@××××××××××××××××.com>,
> > 	gentoo-security@l.g.o
> > User-Agent: Mutt/1.5.5.1i
> > X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.63
> > Subject: Re: [gentoo-security] emerge sync
> >
> > On Tue, Mar 23, 2004 at 10:59:20AM +0100 or thereabouts, Koon wrote:
> > > A rsync mirror compromise could definitely lead to a security problem.
> > >
> > > This is a known problem that is being worked on, and some kind of
> > > digital signing check will be built into the ebuild release / rsync
> > > process someday...
> >
> > For anyone subscribed to gentoo-dev, please see the message I just posted
> > there which details the problem as well as our lack of effort to solve it.
> > Hopefully, enough noise from the community will help give us a swift kick
> > in the butt and a wakeup call.  (hint: that means you folks)
> >
> > --kurt
>
>
>
> --
> gentoo-security@g.o mailing list
>
>

--
gentoo-security@g.o mailing list