From mboxrd@z Thu Jan  1 00:00:00 1970
From: Joanna Rutkowska <joanna@invisiblethingslab.com>
Subject: Re: Xen signing and wget
Date: Tue, 06 Jul 2010 17:27:24 +0200
Message-ID: <4C334B5C.4090305@invisiblethingslab.com>
References: <C8590952.1980C%keir.fraser@eu.citrix.com>
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="===============1058900628=="
Return-path: <xen-devel-bounces@lists.xensource.com>
In-Reply-To: <C8590952.1980C%keir.fraser@eu.citrix.com>
List-Unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xensource.com>
List-Help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-Subscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
Sender: xen-devel-bounces@lists.xensource.com
Errors-To: xen-devel-bounces@lists.xensource.com
To: Keir Fraser <keir.fraser@eu.citrix.com>
Cc: "xen-devel@lists.xensource.com" <xen-devel@lists.xensource.com>
List-Id: xen-devel@lists.xenproject.org

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--===============1058900628==
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature";
	boundary="------------enigE5E9BB7BA72452B0ACD171C8"

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enigE5E9BB7BA72452B0ACD171C8
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

On 07/06/10 17:24, Keir Fraser wrote:
> On 06/07/2010 16:23, "Joanna Rutkowska" <joanna@invisiblethingslab.com>=

> wrote:
>=20
>>> We download tarballs from http://xenbits.xensource.com/xen-extfiles r=
ather
>>> than random 3rd party sites. And qemu from our very own git repositor=
y also
>>> on xenbits.
>>>
>> But you use plaintext connection, which, in security, means random cod=
e.
>> I think we have already went through this last time when discussing th=
e
>> signing process for Xen ;)
>=20
> Okay, then make a patch, including hashes for our current collection of=

> downloads.

I'm not a Xen developer. I do not sign your tarballs...

joanna.


--------------enigE5E9BB7BA72452B0ACD171C8
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkwzS10ACgkQORdkotfEW87yWwCg+edGX4on2laEPVYpppm4friT
6qkAoJFRscvDPEESlr7pkfvIK5qyiuBT
=iMUr
-----END PGP SIGNATURE-----

--------------enigE5E9BB7BA72452B0ACD171C8--


--===============1058900628==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

--===============1058900628==--