Packages and ISO files's signature and verification

(3 posts) (2 voices)

Tags:

No tags yet.

AnhHuynh

offline
Member

Hi,

The tazpkg scripts download files from the (main) mirror and verify them using md5 method. This is very traditional and I think the packages can be easily modified by 3rd parties.

Is there any feature / plan to support more secure signature and verification methods? (Using GPG for example)

Thanks

Posted 8 years ago #
hackdorte

offline
Member

See: /var/lib/tazpkg/packages.md5

Posted 8 years ago #
AnhHuynh

offline
Member

@Hackdorte: Yes I see that file, but I don't think that is enough.

Posted 8 years ago #

Reply

You must log in to post.