Re: [Leaf-devel] bootstrapping signed packages

2001-02-21 Thread Mike Sensney
Mike Sensney wrote: I may be missing something, but I think Mark was thinking about some sort of public/private key signature of the whole package, not the contents. Interesting, but what's the point? ??Not sure what you mean?? This is what Mark asked for in his message. My thought is

Re: [Leaf-devel] bootstrapping signed packages

2001-02-21 Thread Mark Seiden
On Tue, Feb 20, 2001 at 05:05:52PM -0600, [EMAIL PROTECTED] wrote: On 20 Feb 2001, at 22:38, Mark Seiden wrote: i'm about to switch to oxygen, which i've built on 2.2.18 (i hope...) for our beta test. Thanks for using Oxygen! when (not if) you run out of room on a single floppy,

Re: [Leaf-devel] bootstrapping signed packages

2001-02-21 Thread Scott C. Best
A quick thought about encrypting and signing. From Schneier's _Applied Cryptography_, section 2.7, the way to do this is to first sign the deliverable in the private key of the distribution, and then encrypt the deliverable *along with the signature* into a single file. So if the package

[Leaf-devel] bootstrapping signed packages

2001-02-20 Thread Mark Seiden
greetings. i personally am new at this leaf thing, but: we've been using lrp for the alpha test of a bunch of distributed caches for publishing scholarly journals. (see www.lockss.stanford.edu if that interests you.) thanks for all your great work, by the way. i'm about to switch to oxygen,

Re: [Leaf-devel] bootstrapping signed packages

2001-02-20 Thread ssrat
On 20 Feb 2001, at 22:38, Mark Seiden wrote: i'm about to switch to oxygen, which i've built on 2.2.18 (i hope...) for our beta test. Thanks for using Oxygen! when (not if) you run out of room on a single floppy, which contains "trustworthy" software, how to download additional .lrps in

Re: [Leaf-devel] bootstrapping signed packages

2001-02-20 Thread ssrat
On 21 Feb 2001, at 1:31, [EMAIL PROTECTED] wrote: On Tue, Feb 20, 2001 at 05:05:52PM -0600, [EMAIL PROTECTED] scribbled: Having said that, one of the things on my list of "ToDos" is to change apkg to generate *.md5 for every file in the package for checking purposes. This would mean: