search

wendellchao / opkg

Automatically exported from code.google.com/p/opkg
0 stars 0 forks source link

Support signed packages #132

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago 
Currently package feeds may be signed but individual package files are only 
verified by md5sum and/or sha256sum.

We should add a config option to enable a detached signature to be downloaded 
along with each package file and verified. This provides a higher level of 
security and brings us in line with what other package managers can do.

Original issue reported on code.google.com by paul.betafive on 8 May 2014 at 2:55

GoogleCodeExporter commented 9 years ago 
This feature is now implemented on the master branch (commit ID f2fefdf). The 
relevant config option is 'check_pkg_signature'.

Original comment by paul.betafive on 12 Oct 2014 at 10:31