Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #197974

Re: trusting .deb packages

From Andrew McGlashan <andrew.mcglashan@affinityvision.com.au>
Newsgroups linux.debian.user
Subject Re: trusting .deb packages
Date 2018-07-25 07:50 +0200
Message-ID <wfkQp-Oq-3@gated-at.bofh.it> (permalink)
References <wf7Jw-8gM-3@gated-at.bofh.it> <wf8FA-xm-11@gated-at.bofh.it> <wfao1-1Os-1@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256



On 25/07/18 04:31, john doe wrote:
> Also verifying signature using gnupg and checksum is a must
> (sha512).

Such verification is suspect, anyone can create gpg keys for anyone
(so trust in the keys used is essential, but more difficult to attain)
and if you download "supporting" files from a site, then the checksums
and signatures can verify perfectly well ..... but the product is
still suspect.

Cheers
A.
-----BEGIN PGP SIGNATURE-----

iF4EAREIAAYFAltYDTgACgkQqBZry7fv4vt0VgEA1Cx87E2K9PHmEULOTERoFUUb
zZiLtUyhoGJBT43DTWkA/jAmGWRc+NxWZ16bRDmWYkwWdy1ArYQbZedfQI75d43+
=9all
-----END PGP SIGNATURE-----

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

trusting .deb packages Anil Duggirala <anilduggirala@fastmail.fm> - 2018-07-24 17:50 +0200
  Re: trusting .deb packages Dan Ritter <dsr@randomstring.org> - 2018-07-24 18:50 +0200
    Re: trusting .deb packages Anil Duggirala <anilduggirala@fastmail.fm> - 2018-07-24 20:00 +0200
    Re: trusting .deb packages john doe <johndoe65534@mail.com> - 2018-07-24 20:40 +0200
      Re: trusting .deb packages Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-07-25 07:50 +0200
        Re: trusting .deb packages john doe <johndoe65534@mail.com> - 2018-07-25 11:40 +0200
    Re: trusting .deb packages Matthew Crews <mailinglists@mattcrews.com> - 2018-07-24 23:50 +0200
      Re: trusting .deb packages Rick Thomas <rbthomas@pobox.com> - 2018-07-25 04:40 +0200
        Re: trusting .deb packages Matthew Crews <mailinglists@mattcrews.com> - 2018-07-25 04:40 +0200
          Re: trusting .deb packages Gene Heskett <gheskett@shentel.net> - 2018-07-25 05:20 +0200
          Re: trusting .deb packages Ben Caradoc-Davies <ben@transient.nz> - 2018-07-25 05:40 +0200
        Re: trusting .deb packages Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-07-25 07:50 +0200
      Re: trusting .deb packages Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-07-25 08:00 +0200
        Re: trusting .deb packages Darac Marjal <mailinglist@darac.org.uk> - 2018-07-25 16:00 +0200
          Re: trusting .deb packages Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-07-25 17:40 +0200
            Re: trusting .deb packages Brian <ad44@cityscape.co.uk> - 2018-07-25 17:50 +0200
  Re: trusting .deb packages Ben Caradoc-Davies <ben@transient.nz> - 2018-07-25 00:00 +0200
    Re: trusting .deb packages Ben Caradoc-Davies <ben@transient.nz> - 2018-07-25 02:30 +0200
      Re: trusting .deb packages Anil Duggirala <anilduggirala@fastmail.fm> - 2018-07-25 03:10 +0200
        Re: trusting .deb packages Ben Caradoc-Davies <ben@transient.nz> - 2018-07-25 03:40 +0200

csiph-web