Re: [Gnu-arch-users] Re: (fairly minor) SECURITY ISSUE

[Robert Collins]

On Fri, 2004-01-23 at 05:55, Samuel Tardieu wrote:
> >>>>> "Rob" == Rob Kaper <address@hidden> writes:
> 
> > GPG clearly labels what part of a file is signed. If you fetch the
> > md5sum summary from outside the boundaries GPG gives you, GPG can't
> > help you.
> 
> Exactly.

...

As has been pointed out several times: getting the data -from- gpg is
the Right Way. So, whos up to make a patch? I don't have time now, and
won't for some time to do this, but we should have this in for 1.2, as
it will change the check scripts.

Rob
-- 
GPG key available at: <http://www.robertcollins.net/keys.txt>.

signature.asc
Description: This is a digitally signed message part