FS#25764 - Enforce SHA usage in (new) PKGBUILDs.
Attached to Project:
Arch Linux
Opened by einar (esjurso) - Friday, 26 August 2011, 03:59 GMT
Last edited by Andrea Scarpino (BaSh) - Friday, 02 December 2011, 11:40 GMT
Opened by einar (esjurso) - Friday, 26 August 2011, 03:59 GMT
Last edited by Andrea Scarpino (BaSh) - Friday, 02 December 2011, 11:40 GMT
|
Details
I suggest a change in policy that requires maintainers to
use SHA in official PKGBUILDs that are newly created or
modified.
I also suggest that makepkg -g should default to SHA. |
This task depends upon
Closed by Andrea Scarpino (BaSh)
Friday, 02 December 2011, 11:40 GMT
Reason for closing: Not a bug
Additional comments about closing: This isn't the right way to secure PKGBUILDs
Friday, 02 December 2011, 11:40 GMT
Reason for closing: Not a bug
Additional comments about closing: This isn't the right way to secure PKGBUILDs
IMHO developers should always replace the signature with what is in the announcement email from upstream.
Which makepkg can btw. http://allanmcrae.com/2011/08/pacman-package-signing-1-makepkg-and-repo-add/