Kevin Kofler wrote:
As I've already stated multiple
times, the DVD MUST be fixed to include the updates repository for
upgrades
And that means that bug 998 needs to be fixed.
Installing packages from the ISO image without checking them is OK, because a
security-conscious user will have verified the image already, and if the image
has been tampered with then it's already too late by the time Anaconda runs.
Packages that Anaconda downloads are a different matter. Those haven't been
verified by the user so they must be verified by Anaconda.
As long as bug 998 remains unfixed I hope it will at least be possible to make
a fresh install from an ISO image, using only what is included in the image.
Otherwise I don't see how Fedora could be installed securely. Upgrading
securely is still possible with Yum, but installation requires Anaconda as far
as I know.
Björn Persson