Re: [SCRIPT] Generate SHA256SUM files for the mirror
"Daniel Shahaf" <[email protected]>
| Newsgroups | gmane.comp.shells.zsh.devel |
|---|---|
| Message-ID | <[email protected]> |
We might want to have rsyncd.conf exclude MD5SUM and SHA256SUM (and possibly *.asc) from the "pub" dataset, thus forcing people to download them from *.zsh.org directly. This would mean an active attacker with root access to a mirror wouldn't be able to "just" replace the .tar.xz file and recalculate the checksums; they'd have to collide the SHA256 checksum (and possibly forge a signature under the true key) as well.