cvs: peardoc /en/pyrus/differences frompear.xml

cellog		Wed Jun 24 14:04:29 2009 UTC

  Modified files:              
    /peardoc/en/pyrus/differences	frompear.xml 
  Log:
  add note about recently committed awesome openssl signing support
  
http://cvs.php.net/viewvc.cgi/peardoc/en/pyrus/differences/frompear.xml?r1=1.5&r2=1.6&diff_format=u
Index: peardoc/en/pyrus/differences/frompear.xml
diff -u peardoc/en/pyrus/differences/frompear.xml:1.5 peardoc/en/pyrus/differences/frompear.xml:1.6
--- peardoc/en/pyrus/differences/frompear.xml:1.5	Thu Jun 18 22:12:48 2009
+++ peardoc/en/pyrus/differences/frompear.xml	Wed Jun 24 14:04:29 2009
@@ -40,6 +40,20 @@
     of security that is much higher than PEAR supports, while preserving the
     flexibility that extending the installer provides.
    </para>
+   <para>
+    Pyrus also feaures true package signing and signature verification
+    using OpenSSL PKCS#12 and X.509 certificates.  This allows users
+    to directly verify the validity of a package, protecting from
+    man-in-the-middle attacks and other potential disruptions of a package
+    release.  This feature requires the openssl extension, which is not
+    enabled by default.
+   </para>
+   <para>
+    PEAR supports signing packages using PGP keys, but has no mechanism
+    in place to verify the signed packages.  Pyrus will refuse to install
+    a signed package without verifying the signature even if the openssl
+    extension is not enabled.
+   </para>
   </section>
   <section xml:id="pyrus.differences.frompear.overview.smaller">
    <title>Smaller than PEAR</title>