Re: [zynaut] Re: Repoteus: Zynot Tree Vision

--===============47724928911160358==
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature";
	boundary="=-9FdM8T48EQGvQwcLhq3n"


--=-9FdM8T48EQGvQwcLhq3n
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

On Mon, 2003-07-14 at 07:10, Mark Guertin wrote:
> On 7/14/03 7:07 AM, "jesse" <[email protected]> wrote:
>=20
> > Im not saying its a good idea :P but its somthing i could use in day to
> > day opperations. As it is i just sync the make.conf umong all my like
> > servers .. so that the packagedir thats shared between them is the same=
,
>=20
> Right, but this also brings in the larger discussion of p2p ability that =
a
> lot of people are pushing to have.   While it's a neat concept it's also =
a
> sysadmin's _nightmare_.  I run a fairly large LAN here and I would never =
in
> _any_ way allow this sort of installation (pkgs from from who knows where=
)
> to be installed on any of my computers.
>=20
> People will argue the point that they are signed, etc... But that doesn't
> stop someone from building a trojaned binary and singing it.  It just mak=
es
> my spider senses tingle thinking about it....
>=20
> Just more fuel for the fire... ;)
>=20
If they are isgned by our devs who are on your keyring .. then you
should be able to trust. Esp if it's got 2 or more valid sigs.=20

Over any  distrib medium a package that had this requirement would be
considered pristine. You would be able to check those sigs agains
keyservers as well as your local copy of the pubkeys.you could trust
that package if all those check were ok.=20

If random joe-schmo  builds a binary and pops it on p2portage signed. It
doesnt give it any more credability in the eyes of porteous. ( not part
of or keysystem ).=20



> Mark


--=-9FdM8T48EQGvQwcLhq3n
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQA/ExGY4rKvBkfUvb0RAlpqAKC3nejkd6I9gWi9wRj6mVRYyLn1VgCgsRGz
KUwwSGCO5eL93UcFUXg69Xo=
=Wfm1
-----END PGP SIGNATURE-----

--=-9FdM8T48EQGvQwcLhq3n--


--===============47724928911160358==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Zynot-pkgmgr mailing list
[email protected]
http://lists.zynot.org/mailman/listinfo/zynot-pkgmgr

--===============47724928911160358==--