From mboxrd@z Thu Jan  1 00:00:00 1970
From: Keir Fraser <keir.fraser@eu.citrix.com>
Subject: Re: Xen signing and wget
Date: Tue, 6 Jul 2010 16:24:50 +0100
Message-ID: <C8590952.1980C%keir.fraser@eu.citrix.com>
References: <4C334A8C.1080007@invisiblethingslab.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xensource.com>
In-Reply-To: <4C334A8C.1080007@invisiblethingslab.com>
List-Unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xensource.com>
List-Help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-Subscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
Sender: xen-devel-bounces@lists.xensource.com
Errors-To: xen-devel-bounces@lists.xensource.com
To: Joanna Rutkowska <joanna@invisiblethingslab.com>
Cc: "xen-devel@lists.xensource.com" <xen-devel@lists.xensource.com>
List-Id: xen-devel@lists.xenproject.org

On 06/07/2010 16:23, "Joanna Rutkowska" <joanna@invisiblethingslab.com>
wrote:

>> We download tarballs from http://xenbits.xensource.com/xen-extfiles rather
>> than random 3rd party sites. And qemu from our very own git repository also
>> on xenbits.
>> 
> But you use plaintext connection, which, in security, means random code.
> I think we have already went through this last time when discussing the
> signing process for Xen ;)

Okay, then make a patch, including hashes for our current collection of
downloads.

 K.