[Gnu-arch-users] Re: (fairly minor) SECURITY ISSUE

[Samuel Tardieu]

>>>>> "Rob" == Rob Kaper <address@hidden> writes:

> GPG clearly labels what part of a file is signed. If you fetch the
> md5sum summary from outside the boundaries GPG gives you, GPG can't
> help you.

Exactly.

"gpg" (alone) will take the standard input, check the signature, and
output the signed part on the standard output. Using this output to
get the checksums from seems to be the most correct solution.

If you do not wish to check signatures, you can use "cat" instead (or
do not use the .check file at all). If you wish to use X.509, use a
similar command with "openssl". As mentionned in this list already, it
will also demangle content that would have been encoded by GnuPG.

  Sam
-- 
Samuel Tardieu -- address@hidden -- http://www.rfc1149.net/sam