On Tue, Apr 04, 2017 at 12:49:16AM +0700, Vadim A. Misbakh-Soloviov wrote: > > What is the gain of using a secure hash > > algorithm in the manifests if you can simply replace the manifest with a > > MITM attack on the rsync update? > I'd say "the solution is to stop using rsync and use git" (there is git > mirror > with all the metadata), but... > Git does not support (correct me, if I'm wrong) resuming a fetch in case of > fails (bad connection, slow connection, or the any other reason to stop it > and > continue later). Upstream is still working on resumable fetch, and if you need it already, it can be had via git bundles.
-- Robin Hugh Johnson Gentoo Linux: Dev, Infra Lead, Foundation Trustee & Treasurer E-Mail : [email protected] GnuPG FP : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85 GnuPG FP : 7D0B3CEB E9B85B1F 825BCECF EE05E6F6 A48F6136
