Mailinglist Archive: opensuse-project (496 mails)

< Previous Next >
Re: [opensuse-project] Re: zypper slow
On Tuesday, April 26, 2011 04:52:22 AM Michael Schroeder wrote:

Note that download.opensuse.org is just providing a list of mirrors
through the "metalink" mechanism, the real repository data and packages
are fetched from the mirrors.

This is new to me.

http://old-en.opensuse.org/Libzypp/Failover
Last edit by Peter was on March 3rd, 2009.

This is at the very bottom of the article:
"It is noteworthy that the origin server (download.opensuse.org) does not
redirect for metadata and signatures to any mirror, so the clients always get
those critical files from the origin site. If clients are using mirrors
directly, the tradeoff is that they are less secure."

Is this changed since then?
If yes, what is replacing that?
Regular checks of metadata are not real replacement, as rogue mirror can
answer to download.opensuse.org with correct version, and to other clients
with rogue metadata.

--
Regards,
Rajko
--
To unsubscribe, e-mail: opensuse-project+unsubscribe@xxxxxxxxxxxx
For additional commands, e-mail: opensuse-project+help@xxxxxxxxxxxx

< Previous Next >
Follow Ups