Re: server secret

On Thu, Oct 10, 2002 at 03:33:22PM -0400, Hunter Matthews wrote:
> Should it still be called the 'server_secret' in 1.5? 
> 
> Speaketh ye now, or forever shall ye call it.

I think secret is better than salt or seed, we're not really salting the
algorithm. It's really a keyed digest, so maybe key but people will
probably automatically think of PKI. 

Some random wibblings which may help people understand the behaviour:

What you are doing is a message integrity check of the sysid, which
itself contains the checksum string.  

As current is anonymous so we don't store state of the clients, the
secret provides the ability to authenticate based on the secret. A quick
test follows:

If you modify (after backing up!) the checksum of the systemid (or I
guess any relevant field)

[root@scoop RPMS]# up2date compat-egcs
Error communicating with server.  The message was:
Broken response from the server.

Restore the file and all works as normal.  Seems a good solution,
although the error message from up2date is a bit vague :)

Paul