Hi,

As you might have seen in this CVS commit:

> Log message:
>         Fix creation of pyc files in the Scripts package.
>         This change will affect signed packages containing pyc files.
>         For stuff in the 013 repository, we will resign.
>         This is important as it can be considered a security fix too.

An important fix was made: .pyo and .pyc files were being skipped by
ListProgramFiles, which is being used by SignProgram and
VerifyProgram.
Changing this will have a bad side effect: Scripts < 2.5.5 will fail checking
the signature of Scripts >= 2.5.5 (and packages signed with them which
contain .pyc files).

The workaround then will be to run SymlinkProgram on the new Scripts by hand.

To minimize hassles, one option would be to ship Scripts 2.5.5 as an
unsigned package. Do you think this is something worth doing?

-- Hisham
_______________________________________________
gobolinux-devel mailing list
[email protected]
http://lists.gobolinux.org/mailman/listinfo/gobolinux-devel

Reply via email to