--65ImJOski3p8EhYV
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

grant beattie <grant@NetBSD.org> wrote:
=20
> we have the ability to cryptographically sign binary packages, which
> can be automatically verified by pkg_add.

Any details?  Signed by who and how?

> I'd rather the effort be channeled into making this happen, rather
> than adding checksums that will ~never be checked.

Hmmm, are you suggesting that, for the same reason,
ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0/i386/binary/sets/*SUM are
~never checked?  And should hence not be offered?

Adding the creation of the checksums (for manual checks) to the upload
script should be fairly trivial to do -- extending pkg* tools to
register and check signatures should be a fair bit more complex.

I'm not saying that adding signature checking to pkg* is not a good idea
(on the contrary, I would love to see that), but investing the small
effort of providing at least some checksum seems better to me than lean
back and wait for Somebody Else to work out the more complex task.

-Jan

--=20
What do you mean, why has it got to be built? It's a=20
bypass. Got to build bypasses.

--65ImJOski3p8EhYV
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (NetBSD)

iD8DBQFB8wKwfFtkr68iakwRAjEIAJ94Z8JjzAAEIqK54TKOy+y2/oA2EgCfW+cL
eByZc1R7YbsClT9xplVJbRs=
=jsg+
-----END PGP SIGNATURE-----

--65ImJOski3p8EhYV--