[gentoo-security] Re: Let's blow the whistle

[Peter Simons]

Anthony Metcalf writes:

 > I am not seeing the difference between that though and
 > the signed hashes that are already implemented.

You are right, technically, there isn't a difference really.
The only difference is that a signed list of hashes is very
easy to generate, it is very easy to verify, and it needs
only one GPG to do it. The solution Gentoo is aiming for in
the long run, however, is difficult to create, difficult to
verify (without using the Gentoo tools, which you can't use
before you have verified them -- bootstrapping!), and it
will use several dozen GPG keys. So the only difference is
in the complexity.

My proposal is purely aimed at solving a security problem
_right now_, the real solution aims to do much more.

Peter


--
gentoo-security@g.o mailing list