Re: [Gnu-arch-users] tla--devo--1.2 has preliminary gpg stuff

[Tom Lord]

    > From: Johannes Berg <address@hidden>

    >> I don't see that as a bug. Checksum files are worthless if they're not
    >> signed. After all, if the patches have been modified by a nefarious
    >> person, then the checksum file could be modified to match.=20

    > Yes, but checksum files are always present, even in an unsigned
    > archive.  But then again, you wouldn't run the check on that
    > archive. Never mind, for some reason I was thinking you'd do
    > that.

I suppose that if you're checking against an externally vetted list of
checksums you don't, strictly speaking, need to check the ones in the
archive (though it is probably convenient to have them there).

But if you're checking for media or xmission failures, then you do
want to check the ones in the archive, even if they are unsigned.

-t