On Tue, May 29, 2012 at 01:38:07PM +0200, dieter wrote:
On Tue, 29 May 2012 13:25:31 +0200 "Carlos E. R."
wrote: But the good news: only for factory, for released products we do redirect to mirrors.
Is this correct now, for the normal distro no metadata comes directly from openSUSE now, everything from the mirrors?
IMO, that is a security concern.
I *hope* the security never depends on the server but on cryptographically signing the files - and verifying the validity of the signature before using them.
Depends on where you got the install media from. If you ensure integrity of the install medium, everything else gets GPG key based checking. CIao, Marcus -- To unsubscribe, e-mail: opensuse-factory+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse-factory+owner@opensuse.org