On Mon, Aug 11, 2003 at 01:42:32PM -0700, Florin Andrei <florin(a)sgi.com> said
"Hewlett-Packard, IBM, RSA Security, InstallShield Software, and
Microsystems are also involved in the File Signature Database (FSDB)
effort. The repository will store metadata about individual files
created by each of the vendors, such as the file's name, a ¡born-on¢
date and its digital hash values."
Any plans to do that with Red Hat as well?
This sounds a lot like what can already be done with a command like rpm -Va.
The rpm database already stores MD5 sums, file sizes, modification
timestamps, file permissions, etc. for every installed package. Packages
themselves can be GPG signed to guarantee authenticity. For added security a
copy of the rpm database along with an rpm executable could be stored on some
read only media and the verify happen from there.
Geoffrey Reedy vader21(a)imsa.edu