(courtesy CC requested, I'm not on the list, thanks) Hi debian-dpkg,
I know you can use apt-secure to determine the validity of a not yet installed deb. A) Is there a way to determine the validity of an installed deb? B) Is there a way to determine if a file you have on your system came from a valid deb? (I suspect the ability to do A requires the ability to do B, right?) Most debs have md5sum files these days, and the debsums tool can compare the installed files against /var/lib/dpkg/info/foo.md5sum. But it isn't intended to be used as an integrity checker, since those files are subject to manipulation. Is there a way to link the apt-secure checked deb to the md5sum file it contains in order to prove that files are OK? Like maybe a signed document listing the md5sums of all the md5sum files? Any other ideas? I would like to have this ability for an auditing tool I'm writing. Thanks, -- Matt Taggart [EMAIL PROTECTED] -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
