Neil Baker <[email protected]> writes: > Hi, > > > > I was wondering if anyone happens to have the md5sums for the CentOS / > RedHat RPMs for Son of Gridengine?
Which rpms, not that it changes the answer? > My boss is very careful when it comes to installing software and wants to > make sure the RPMs in the repository are the ones that they should be and > haven't been modified by a hacker since you uploaded them. Hence the > md5sums to prove that they haven't been tampered with. How does an md5 help more than the PGP signature on the ones distributed from Liverpool? (Those built in Fedora copr can't be signed, unfortunately.) If someone tampered with the packages, they presumably would make md5s from the same place consistent. [I think the non-el5 rpms have internal md5, but I think that's for checking the integrity of the installation.] I don't know why Toshiba should particularly trust me or university infrastructure, anyhow... In general, if people want assurance on software, I expect they'll have to contract and pay for it. I approve of worrying, of course. It bothers me the degree to which people expect to run random binaries of basically unknown provenance as a matter of course. [The best way to provide integrity and reproducibility checks is probably Nix/Guix, though it covers the whole dependency tree.] I'd recommend rebuilding the source to provide more confidence, though you want to be circumspect even with that. It's trivial from the source packaging, but you'd probably need darcs to recreate the tarball from the repository. Sorry that probably doesn't help much! _______________________________________________ SGE-discuss mailing list [email protected] https://arc.liv.ac.uk/mailman/listinfo/sge-discuss
