Yes, if you look at the script, there are GPG signature performed. example: http://jlcooke.ca/go?2.4.18/CA | less Ideally, I'd rather have an SSL tunnel to the script...but that depends on the server. JLC On Sun, Jul 07, 2002 at 09:50:04AM +0200, David Gümbel wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > On Sonntag, 7. Juli 2002 04:17:04, Jean-Luc Cooke wrote: > > "make clean; make get_crypto; make menuconfig; make bzImage; make > > modules;" ^^^^^^^^^^^^^^^ > > New kernel make command! > > > > This command would hold nothing but a few shell commands, one being: > > lynx -source http://www.kerneli.org/go?<kernelVersion>/<countryCode> | sh > > I don't really believe that getting a) crypto stuff for b) the kernel by > piping unencrypted content into a shell without prior verification could > possibly provide additional security. Do you have plans to use digital > signatures or something that might guarantee data integrity and verify that > the downloaded content is really from the author it is supposed to be? > > > > > Regards, > > > > David > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.0.7 (GNU/Linux) > Comment: http://david-guembel.de/webpgp.html > > iD8DBQE9J/KscWkuqYXk/uwRAvqkAKCqyYPoC/IqaTEENrC3dqGU3sqi4wCfUSyC > pwsk7hOj1zGyy8LYbG0gM1g= > =GIPP > -----END PGP SIGNATURE----- -- http://www.certainkey.com Suite 4560 CTTC 1125 Colonel By Dr. Ottawa ON, K1S 5B6 C: 613.263.2983 - Linux-crypto: cryptography in and on the Linux system Archive: http://mail.nl.linux.org/linux-crypto/
