Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sources.redhat.com/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sources.redhat.com/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com
Date:	Thu, 16 May 2002 23:43:22 -0400
From:	Christopher Faylor <cgf-cygwin AT cygwin DOT com>
To:	cygwin AT cygwin DOT com
Subject:	Re: PGP signatures for packages?
Message-ID:	<20020517034322.GD22415@redhat.com>
Reply-To:	cygwin AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
References:	<000501c1fd52$a512c1a0$c23fa8c0 AT transarc DOT ibm DOT com>
Mime-Version:	1.0
In-Reply-To:	<000501c1fd52$a512c1a0$c23fa8c0@transarc.ibm.com>
User-Agent:	Mutt/1.3.23.1i

On Thu, May 16, 2002 at 11:26:30PM -0400, Michael Young wrote:
>Are signatures available for the setup program, or for the packages it
>downloads?
>RPM uses GPG signatures, but I can't find anything comparable for the Cygwin
>binaries.  Even just a list of hashes would be worthwhile (ideally vended from
>a secure Cygwin/Redhat web page) to verify that a mirror (or download) hasn't
>been corrupted.  Real PGP signatures would be better.  I can live without tool
>support -- I can do the verifications manually, but only if I can find the
>signatures :-).
>
>I saw a note back in December
>(http://sources.redhat.com/ml/cygwin/2001-12/msg00950.html)
>that touched on this, but I couldn't find any followup.  Did this wither on the
>vine?

No.  It's actually part of the current setup.exe.

FWIW, md5sums in the download directories have been available for years.

cgf

--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Bug reporting:         http://cygwin.com/bugs.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/

- Raw text -