vsftpd in the news

[Michael Cronenworth]

On 07/05/2011 03:46 AM, Michael Schwendt wrote:
> Some packagers do upload the detached sig and add it to the spec
> as another Source file URL.

Great! Except I haven't done so. I wasn't required to submit a signature 
for my package nor does the Package Guildline pages refer to doing so. 
Might be worth someone's time to mention it on the wiki (who knows about 
this functionality).

> The uploaded tarball checksum enters the "sources" file in git, and any
> tarball downloaded from the lookaside cache MUST match that checksum.
> Else it wouldn't be downloaded and used. Source RPM build in koji would
> fail.

This is just a checksum against the tarball that enters the lookaside 
cache. Yes, I know about this. A malicious package could have been 
uploaded to the lookaside cache, however. This leads to demanding 
everyone have signatures available, but what do you do about SVN/Git 
checkouts or projects that don't wish to provide signatures?