Re: [Sks-devel] Secure packaging

[David Shaw]

On Fri, Dec 05, 2003 at 12:52:52PM -0500, Yaron M. Minsky wrote:

> In light of the savannah break-in, and general caution, it seems
> like some kind of package-signing might be in order.  Peter
> Palfrader is brought this issue up to me, and it seems like a good
> idea.  Do people have any thoughts on the best way to distribute
> signed distributions?  How do people normally go about it?

Build the usual tarball, and make a detached signature.  End result is
tarball.tar.gz and tarball.tar.gz.sig.  Distribute the two together.

David