Re: 1.2.0-rc2 tarballs up for testing/signing

Ben Collins-Sussman wrote:
>> Could someone explain to me the purpose of signatures when the sums
>> have been provided by the packager?
>
> "I, as a committer on the svn project, have hereby tested these tarballs
> and deem them suitable for release to the general public."

So you're assuming that the tarball you received is good, or you pulled
and created your own tarball?

If yes to the first part, isn't that a flawed scenario if an attacker
got to it before you signed it?

-- 
Andrew Thompson
http://aktzero.com/
Interested in a hosted SVN repository? Email me, let's talk...
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org