vsftpd in the news

Tue Jul 5 08:46:02 UTC 2011

On Mon, 4 Jul 2011 23:53:38 -0400 (EDT), PW (Paul) wrote:

> It would be nice if we could upload/commit the .asc or .sig file, and have the rpmbuild script
> automatically check the tar ball.

Some packagers do upload the detached sig and add it to the spec 
as another Source file URL.

The uploaded tarball checksum enters the "sources" file in git, and any
tarball downloaded from the lookaside cache MUST match that checksum.
Else it wouldn't be downloaded and used. Source RPM build in koji would
fail.