Re: [SCRIPT] Generate SHA256SUM files for the mirror

Clinton Bunch <[email protected]>
Newsgroups gmane.comp.shells.zsh.devel
Message-ID <[email protected]> 
On 4/24/2026 04:39, Daniel Shahaf wrote:
> We might want to have rsyncd.conf exclude MD5SUM and SHA256SUM (and possibly *.asc) from the "pub" dataset, thus forcing people to download them from *.zsh.org directly.  This would mean an active attacker with root access to a mirror wouldn't be able to "just" replace the .tar.xz file and recalculate the checksums; they'd have to collide the SHA256 checksum (and possibly forge a signature under the true key) as well.
>
I think that would make these bots more likely to flag the mirrors.  
Maybe clear sign the SUM files?
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.