From ilug-admin@linux.ie Tue Oct 8 11:13:35 2002 Return-Path: Delivered-To: zzzz@localhost.example.com Received: from localhost (jalapeno [127.0.0.1]) by example.com (Postfix) with ESMTP id 15A8716F16 for ; Tue, 8 Oct 2002 11:13:35 +0100 (IST) Received: from jalapeno [127.0.0.1] by localhost with IMAP (fetchmail-5.9.0) for zzzz@localhost (single-drop); Tue, 08 Oct 2002 11:13:35 +0100 (IST) Received: from lugh.tuatha.org (postfix@lugh.tuatha.org [194.125.145.45]) by dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id g98A7PK10544 for ; Tue, 8 Oct 2002 11:07:26 +0100 Received: from lugh.tuatha.org (localhost [127.0.0.1]) by lugh.tuatha.org (Postfix) with ESMTP id 60B92341EE; Tue, 8 Oct 2002 11:08:11 +0100 (IST) Delivered-To: linux.ie-ilug@localhost Received: from linuxmafia.com (linuxmafia.COM [198.144.195.186]) by lugh.tuatha.org (Postfix) with ESMTP id 877B5341E1 for ; Tue, 8 Oct 2002 11:07:04 +0100 (IST) Received: from rick by linuxmafia.com with local (Exim 3.36 #1 (Debian)) id 17yrJU-0001Ph-00 for ; Tue, 08 Oct 2002 03:10:04 -0700 To: ilug@linux.ie Subject: Re: [ILUG] packaging risks and the reputation of linux distributions Message-Id: <20021008100959.GL11235@linuxmafia.com> References: <200210081058.50438.brendan@zen.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200210081058.50438.brendan@zen.org> User-Agent: Mutt/1.4i X-Mas: Bah humbug. From: Rick Moen Sender: ilug-admin@linux.ie Errors-To: ilug-admin@linux.ie X-Beenthere: ilug@linux.ie X-Mailman-Version: 2.0.11 Precedence: bulk List-Help: List-Post: List-Subscribe: , List-Id: Irish Linux Users' Group List-Unsubscribe: , List-Archive: X-Original-Date: Tue, 8 Oct 2002 03:09:59 -0700 Date: Tue, 8 Oct 2002 03:09:59 -0700 Quoting Brendan Kehoe (brendan@zen.org): > As a workaround, the various distributions could use a GPG singature > to verify correctness of the file. Since the distributor's secret key > is required to create that signature, it would add a pretty > significant step that would have to be taken to make it possible to > replace both a rpm or apt file and its accompanying signature. There are complex problems inherent in attempts to implement this. http://linuxmafia.com/~rick/linux-info/debian-package-signing -- Cheers, My pid is Inigo Montoya. You kill -9 Rick Moen my parent process. Prepare to vi. rick@linuxmafia.com -- Irish Linux Users' Group: ilug@linux.ie http://www.linux.ie/mailman/listinfo/ilug for (un)subscription information. List maintainer: listmaster@linux.ie