On Tuesday, April 26, 2011 04:52:22 AM Michael Schroeder wrote:
Note that download.opensuse.org is just providing a list of mirrors through the "metalink" mechanism, the real repository data and packages are fetched from the mirrors.
This is new to me. http://old-en.opensuse.org/Libzypp/Failover Last edit by Peter was on March 3rd, 2009. This is at the very bottom of the article: "It is noteworthy that the origin server (download.opensuse.org) does not redirect for metadata and signatures to any mirror, so the clients always get those critical files from the origin site. If clients are using mirrors directly, the tradeoff is that they are less secure." Is this changed since then? If yes, what is replacing that? Regular checks of metadata are not real replacement, as rogue mirror can answer to download.opensuse.org with correct version, and to other clients with rogue metadata. -- Regards, Rajko -- To unsubscribe, e-mail: opensuse-project+unsubscribe@opensuse.org For additional commands, e-mail: opensuse-project+help@opensuse.org