| |||||||||||||
FuntooFuntooPosted Mar 25, 2011 10:03 UTC (Fri) by alex (subscriber, #1355)In reply to: Gentoo Mitigations? by quentin.casasnovas Parent article: Arch Linux and (the lack of) package signing
I did look at Funtoo, unfortunately the git repo (or at least the gentoo mirror side) was just a daily snapshot of the CVS tree. That doesn't give you any confidence that the mirror hasn't been compromised.
Really you want each change to the metadata to be a discreet verifiable commit.
(Log in to post comments)
|
|||||||||||||