toshio@tiki-lounge.com (Toshio) writes:
This isn't secure. If I, the packager, am trying to crack your autobuilder, I can use a Source0: http://cracks.com/autorootkit-1.0.tar.gz
A buildsystem MUST resist against such attacks. See the "upstream author" part in
http://www.tu-chemnitz.de/~ensc/fedora.us-build/html/index.html
Despite this, there must be made some precautions to limit effects of exploits. Recent events do not give me a good feeling regarding Linux's resistance against local exploits.
Enrico