On Fri, 2009-01-16 at 22:23 -0500, Casey Dahlin wrote: > I think its wrong to get the latter out of the keys (though the right > way might mean touching rpm in a way we aren't allowed/able to). Once we > have "This package came from Fedora" then for the rest of the info, we > can just state it in a package header. If the headers are signed then we > have the necessary level of security. We only need one key to provide > the non-refutability. The rest of the information can just be stated. I'd rather state that in the repodata, rather than the rpm itself. Stating it in the rpm would mean changing the rpm file between -testing and updates, which would break the ability to hardlink, and would mean unnecessary churn. -- Jesse Keating Fedora -- Freedom² is a feature! identi.ca: http://identi.ca/jkeating
Attachment:
signature.asc
Description: This is a digitally signed message part
-- fedora-devel-list mailing list fedora-devel-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-devel-list
