Re: trusted vs untrusted packages

[Jeff Johnson <n3npq@nc.rr.com>]

James Morris wrote:

>On Tue, 14 Oct 2003, Russell Coker wrote:
>
>  
>
>>Now this raises some interesting issues.  If a signed package has a program 
>>which relies on some other program (and has a dependency), what happens if 
>>the dependency is satisfied by an unsigned package?  Installing the unsigned 
>>package may not result in the system being fully functional (execution of the 
>>file in question may be denied).
>>    
>>
>
>This should be like enforcing vs. non-enforcing -- you either want all of
>your packages signed (and the above would fail) or not (just generate a
>warning).
>  
>

Not true. The signature mechanism is different than the trust model. 
Existence of
signature, or constraint of all all packages must be signed, is not an 
adequate definition
of "trust".

73 de Jeff



--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.