Re: [Sks-devel] Secure packaging

[Peter Palfrader]

On Fri, 05 Dec 2003, Yaron M. Minsky wrote:

> In light of the savannah break-in, and general caution, it seems like
> some kind of package-signing might be in order.   Peter Palfrader is
> brought this issue up to me, and it seems like a good idea.  Do people
> have any thoughts on the best way to distribute signed distributions? 
> How do people normally go about it?

Distribute a detached signature alongside the tarball.

sks-n.n.n.tar.gz
sks-n.n.n.tar.gz.asc

create said detached sig with 'gpg --armor --detach-sign sks-n.n.n.tar.gz'

For bonus points make sure the signing key is connected to the web of
trust.
Peter
-- 
 PGP signed and encrypted  |  .''`.  ** Debian GNU/Linux **
    messages preferred.    | : :' :      The  universal
                           | `. `'      Operating System
 http://www.palfrader.org/ |   `-    http://www.debian.org/

signature.asc
Description: Digital signature