Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 29 Nov 2005 12:58:15 -0800
From:      Colin Percival <>
To:        aristeu <>
Subject:   Re: Reflections on Trusting Trust
Message-ID:  <>
In-Reply-To: <000201c5f526$5a000400$e403000a@rickderringer>
References:  <000201c5f526$5a000400$e403000a@rickderringer>

Next in thread | Previous in thread | Raw E-Mail | Index | Archive | Help
aristeu wrote:
>> Can you explain what you mean here.  Virtually all distfiles needed to
>> build a port have MD5 and maybe SHA-256 hashes embedded in the ports
>> tree.  The only way to easily circumvent these is to subvert the ports
>> tree - which gets back to the issue of trusting the FreeBSD distribution.
>> I agree that there's currently no integrity checking on packages.
>> (And, BTW, tar has no integrity checks).
> Anyone who is between you and freebsd cvsup server can make his own ports
> tree repository. That being done, he just need to redirect your connection
> and wait 'til your next cvsup sync is done.

This is why I wrote portsnap.

Colin Percival

Want to link to this message? Use this URL: <>