from localhost (jalapeno [127.0.0.1])
	by spamassassin.taint.org (Postfix) with ESMTP id E41D916F03
	for <zzzz@localhost>; Tue,  8 Oct 2002 12:26:47 +0100 (IST)
from jalapeno [127.0.0.1]
	by localhost with IMAP (fetchmail-5.9.0)
	for zzzz@localhost (single-drop); Tue, 08 Oct 2002 12:26:47 +0100 (IST)
from lugh.tuatha.org (postfix@lugh.tuatha.org [194.125.145.45])
    by dogma.slashnull.org (8.11.6/8.11.6) with ESMTP id g98APSK11003 for
    <zzzz-ilug@spamassassin.taint.org>; Tue, 8 Oct 2002 11:25:28 +0100
from lugh.tuatha.org (localhost [127.0.0.1]) by lugh.tuatha.org
    (Postfix) with ESMTP id CAF5134206; Tue,  8 Oct 2002 11:26:11 +0100 (IST)
from dspsrv.com (vir.dspsrv.com [193.120.211.34]) by
    lugh.tuatha.org (Postfix) with ESMTP id C0B96341E1 for <ilug@linux.ie>;
    Tue,  8 Oct 2002 11:25:08 +0100 (IST)
From ilug-admin@linux.ie  Tue Oct  8 12:26:48 2002

Brendan Kehoe wrote:
> As a workaround, the various distributions could use a GPG singature to verify
> correctness of the file.  Since the distributor's secret key is required to
> create that signature, it would add a pretty significant step that would have
> to be taken to make it possible to replace both a rpm or apt file and its
> accompanying signature.
Check your local friendly Red Hat installation:
[root@localhost up2date]# rpm --checksig zsh-4.0.2-2.src.rpm
zsh-4.0.2-2.src.rpm: md5 gpg ok
Of course, this is only as useful as, say, the gpg keys distributed with
the Kernel tarballs, i.e. if you don't actually bother checking the sig
then you are open to abuse. It's entirely possible that rpm can be
configured to require good signatures, but I've not read that part of
the fine manual just yet.
Cheers,
Waider.
--
waider@waider.ie / Yes, it /is/ very personal of me
--
Irish Linux Users' Group: ilug@linux.ie
http://www.linux.ie/mailman/listinfo/ilug for (un)subscription information.
List maintainer: listmaster@linux.ie

from localhost (jalapeno [127.0.0.1])
	by spamassassin.taint.org (Postfix) with ESMTP id 4C7C016F16
	for <zzzz@localhost>; Tue,  8 Oct 2002 12:27:18 +0100 (IST)
from jalapeno [127.0.0.1]
	by localhost with IMAP (fetchmail-5.9.0)
	for zzzz@localhost (single-drop); Tue, 08 Oct 2002 12:27:18 +0100 (IST)
from n40.grp.scd.yahoo.com (n40.grp.scd.yahoo.com
    [66.218.66.108]) by dogma.slashnull.org (8.11.6/8.11.6) with SMTP id
    g98BAdK12700 for <zzzz@spamassassin.taint.org>; Tue, 8 Oct 2002 12:10:39 +0100
(qmail 60866 invoked from network); 8 Oct 2002 11:11:01 -0000
from unknown (66.218.66.218) by m9.grp.scd.yahoo.com with QMQP;
    8 Oct 2002 11:11:01 -0000
from unknown (HELO gadolinium.btinternet.com) (194.73.73.111) by
    mta3.grp.scd.yahoo.com with SMTP; 8 Oct 2002 11:11:02 -0000
from host217-35-11-51.in-addr.btopenworld.com ([217.35.11.51])
    by gadolinium.btinternet.com with esmtp (Exim 3.22 #8) id 17ysGU-0004CB-00
    for forteana@yahoogroups.com; Tue, 08 Oct 2002 12:11:02 +0100
From sentto-2242572-56010-1034075461-zzzz=spamassassin.taint.org@returns.groups.yahoo.com  Tue Oct  8 12:27:19 2002