Re: [Fink-devel] More on ..GPG Signing the info file and patches..

[Jeremy Erwin]

On Friday, November 29, 2002, at 05:13  PM, Xavier HUMBERT wrote:

And signing the info file is just an extra step, which can be easyly
automated. A detached signature, would add the extra bonus that info
file is not modified, thus no need to modify trhe parsing code. If there
is a "blah-0.9-1.info.asc", verify "blah-0.9-1.info", using packager's
public key, otherwise, skip it.

attack as follows:
break into cvs server, or spoof, or whatnot
delete blah-0.9-1.info.asc
upload new, improved version of blah-0.9.-1.info

victim's computer checks for asc, sees that there is none on file.
victim's computer builds, compiles, and packages trojan horse package.

Jeremy



-------------------------------------------------------
This SF.net email is sponsored by: Get the new Palm Tungsten T handheld. Power & Color in a compact size! http://ads.sourceforge.net/cgi-bin/redirect.pl?palm0002en
_______________________________________________
Fink-devel mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/fink-devel