On Tue, 2008-03-04 at 16:47 -0500, Jesse Keating wrote: > On Tue, 2008-03-04 at 12:45 -0900, Jeff Spaleta wrote: > > Correct me if I'm wrong, but any sort of checksum comparison between > > multiple locally built images wouldn't work as a baseline verifier of > > which repository a spin was built from would it? If 4 different > > people took the kickstart and rebuilt it using the livecd tools on > > different machines at different times, using packages from the fedora > > repository..they wouldn't end up with images with the same checksums > > right? > > I think we'd have to do some verification of the content within the > image, not the image itself. Correct. Between timestamps, squashfs comperession and other fun, the image itself would differ Jeremy _______________________________________________ fedora-advisory-board mailing list fedora-advisory-board@xxxxxxxxxx http://www.redhat.com/mailman/listinfo/fedora-advisory-board
