Re: packages without .md5sums file?
Igor Belyi writes:
> What I think is necessary is a signature on md5sums. There's
> a signature in the *.deb files but those are usually gone
> after installation. If there were <package>.md5sign or
> something like that with signature for md5sums this will
> be quite enough to verify files from the package.
Just to follow up on the issue.
I've sketched a Perl script which introduces md5sign files. This file
is a signed text which contains checksums for control files (md5sums,
postinst, prerm, etc.) and some fields from the control file (only
"Maintainer" for now). This way authenticity of all files can be
verified.
Script is just a "proof of concept" thing but it already can sign and
verify installed packages and DEB archives.
Unfortunately, I don't have time to work on it now. If somebody in
Debian community think there's a ground for this idea, I've put the
script, README, and TODO at
ftp://ftp.katehok.homeip.net/pub/debmd5sign.tar.gz
Good luck and thanks for all the fish.
Igor (Debian user)
Reply to: