Re: Mirrors security

[Alvin Oga <aoga@ns.Linux-Consulting.com>]

On Fri, 4 Feb 2005, Felipe Massia Pereira wrote:

> Hi list,
> 
> I'd like to know more about security procedures for mirrors, mainly how 
> to check the repository for malicious corruption, and if there is a 
> channel which could be used to notify users who download from my mirror.

check the md5 sum of each file from a different mirror
( preferably from 3 different random sources )

for each *.deb
   md5sum  $deb >> /tmp/md5.log
done

diff /tmp/md5.log against your "safe copy" of it

if fail ... ooopssies ... let the fun start to find out what happened

c ya
alvin