From owner-freebsd-security@FreeBSD.ORG  Wed Oct 27 19:48:39 2004
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 6CC1316A4CE; Wed, 27 Oct 2004 19:48:39 +0000 (GMT)
Received: from mail22.syd.optusnet.com.au (mail22.syd.optusnet.com.au
	[211.29.133.160])	by mx1.FreeBSD.org (Postfix) with ESMTP
	id A93D243D1D; Wed, 27 Oct 2004 19:48:38 +0000 (GMT)
	(envelope-from PeterJeremy@optushome.com.au)
Received: from cirb503493.alcatel.com.au
	(c211-30-75-229.belrs2.nsw.optusnet.com.au [211.30.75.229])
	i9RJmbTZ012519
	(version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168 verify=NO);
	Thu, 28 Oct 2004 05:48:37 +1000
Received: from cirb503493.alcatel.com.au (localhost.alcatel.com.au
	[127.0.0.1])i9RJmaxP096633;	Thu, 28 Oct 2004 05:48:36 +1000 (EST)
	(envelope-from pjeremy@cirb503493.alcatel.com.au)
Received: (from pjeremy@localhost)i9RJmaBM096632;
	Thu, 28 Oct 2004 05:48:36 +1000 (EST)	(envelope-from pjeremy)
Date: Thu, 28 Oct 2004 05:48:36 +1000
From: Peter Jeremy <PeterJeremy@optushome.com.au>
To: Colin Percival <colin.percival@wadham.ox.ac.uk>
Message-ID: <20041027194835.GD79646@cirb503493.alcatel.com.au>
References: <417EAC7E.2040103@wadham.ox.ac.uk>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <417EAC7E.2040103@wadham.ox.ac.uk>
User-Agent: Mutt/1.4.2i
cc: freebsd-security@freebsd.org
cc: freebsd-ports@freebsd.org
Subject: Re: please test: Secure ports tree updating
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 27 Oct 2004 19:48:39 -0000

On Tue, 2004-Oct-26 20:58:54 +0100, Colin Percival wrote:
>CVSup is slow, insecure, and a memory hog.  However, until now
>it's been the only option for keeping an up-to-date ports tree,
...
>
>To provide a secure, lightweight, and fast alternative to CVSup,
>I've written portsnap.

It sounds like you've re-invented CTM rather than a CVSup replacement.
Would you care to provide a comparison of portsnap with CTM?  Based on
your description, the differences are:
- portsnap uses HTTP, CTM uses either FTP or mail.
- portsnap is always signed, CTM is only signed via mail.
- CTM is part of the base system
- ports-cur CTM deltas are currently generated every 8 hours

-- 
Peter Jeremy