Date: Mon, 23 Jun 2003 09:24:18 +0200 From: William Fletcher <ultraviolet@epweb.co.za> To: chat@freebsd.org Subject: Re: Cryptographically enabled ports tree. Message-ID: <20030623072418.GF18653@tulip.epweb.co.za> In-Reply-To: <5.0.2.1.1.20030622084009.01c8d600@popserver.sfu.ca> References: <5.0.2.1.1.20030622044124.02cc0948@popserver.sfu.ca> <5.0.2.1.1.20030622022111.02c1cdf8@popserver.sfu.ca> <5.0.2.1.1.20030621193449.02c91ce8@popserver.sfu.ca> <5.0.2.1.1.20030621175853.02c92e00@popserver.sfu.ca> <20030621163835.GA18653@tulip.epweb.co.za> <5.0.2.1.1.20030621175853.02c92e00@popserver.sfu.ca> <5.0.2.1.1.20030621193449.02c91ce8@popserver.sfu.ca> <5.0.2.1.1.20030622022111.02c1cdf8@popserver.sfu.ca> <5.0.2.1.1.20030622044124.02cc0948@popserver.sfu.ca> <5.0.2.1.1.20030622084009.01c8d600@popserver.sfu.ca>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] Hi, again. No use signing if cvsup is a mess. We need cvsup-ssl, Then, all the big security guys need to do is provide a public key for the cvsup-mirrors, which then get the public key for the big cvsup server, etc. That way, cvsup is secure, and we can trust it. Then, we just get all the ports maintainers to provide public keys and then we can download the distfiles from ftp\http and know they're trusted. On the other hand, this means that we don't really need signed distfiles, the md5 checksum should do just fine, because we know that we're getting our ports tree from a trusted source. Thats just how I see it. Please, Please stop me if I'm wrong. Please correct me if I misunderstood all the e-mails in this thread too. -- William Fletcher (ultraviolet) Powered by http://www.FreeBSD.org/ IT Administrator, EPWeb networks. irc at irc.epweb.co.za http://www.epweb.co.za/ http://vision.za.net/irc/ Tel: +27 (041) 395 6800 Fax: +27 (041) 395 6818 Support: support@epweb.co.za For countless days, We walked alone, Directionless and vunerable, Sitting targets wearing smiles. [-- Attachment #2 --] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (FreeBSD) iD8DBQE+9qshju3fq0dMPxsRAhEzAJ4q2SwBAjxlINbiiS0TQCcu5Z0a1ACgnd2N KMVq8JzDHM/sfvdYxysY0ug= =EGqB -----END PGP SIGNATURE-----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030623072418.GF18653>