17 Jul
2012
17 Jul
'12
22:18
On Tue, Jul 17, 2012 at 7:10 PM, Marcus Hüwe <suse-tux@gmx.de> wrote:
Well it's rather an issue with the current workflow:
- ask user if he "trusts" the project(s)
- download the pubkey(s) from the api
- check gpg signature of the packages
It's not as flawed. Once osc has installed the gpg key, it becomes really hard to thwart the process. However, with mere hashes, every time a download takes place is an opportunity to do it. The improvement is nonexistent in theory, but in practice it does help. Besides, users could install the key manually, from a trusted source. That would be the case of appliances, for instance. -- To unsubscribe, e-mail: opensuse-buildservice+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-buildservice+owner@opensuse.org