Re: [Gnu-arch-users] (fairly minor) SECURITY ISSUE

[Tom Lord]

    > From: Colin Walters <address@hidden>

    > On Thu, 2004-01-22 at 08:30, Rob Kaper wrote:

    > > With detached signatures you could avoid all this, because the original 
f=
    > ile
    > > is untouched - you would just sign the .gz and wouldn't even have to 
make
    > > md5sums anymore.

    > Nah...there's two files, the log and the patches.tar.gz.  It's cleaner
    > to have a checksum file and just sign that, instead of having two
    > signatures.

Beyond "cleaner", what signatures sign is not just the contents of
various files but also the listing of the revision directory and its
association with a particular fully-qualified revision name.

-t