DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:reply-to:to:message-id:subject
	:mime-version:content-type:content-transfer-encoding:references;
	 q=dns; s=default; b=S/fjpQsJO2YdtsqyLipEP28Ii0pkhXryYM833tc5omV
	/4k72+vUTjC31aG9cEK1TaOUnicrAqewG/yzKjM6kk06ECdRBcOvRiWSru+5GJtO
	s+1RXm4O4uWbV/rzlwyOczhIpHsiaw4KuvGF7xUF1Gu5tTr2RBHsIc1kK8Z2xfI0
	=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
Date: Wed, 17 Aug 2016 01:49:59 +0000 (UTC)
From:  <lloyd.wood@yahoo.co.uk>
Reply-To:  <lloyd.wood@yahoo.co.uk>
To: "cygwin@cygwin.com" <cygwin@cygwin.com>
Message-ID: <1740128398.25713364.1471398599819.JavaMail.yahoo@mail.yahoo.com>
Subject: Cygwin's installation and security models?
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
References: <1740128398.25713364.1471398599819.JavaMail.yahoo.ref@mail.yahoo.com>


I'd like to understand Cygwin's installation and
security models better: 

- Cygwin's installers aren't signed.
- downloads are from a number of untrusted mirrors
  via http/ftp, and packages aren't verified. 


Is this correct?
thanks
 
Lloyd Wood lloyd.wood@yahoo.co.uk http://savi.sf.net/ 

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple