🚀 go-pugleaf

In article <1992Sep22.005843.4590@Princeton.EDU> mgflax@phoenix.Princeton.EDU (Marshall G. Flax) writes:
>In article <cis.717119132@kraken> cis@kraken.itc.gu.edu.au (Tony O'Hagan) writes:
>>I have ftp'd pgp20.zip from 2 different sites (binary mode) and
>>downloaded them to my humble PC to discover that PKUNZIP considers
>>that SOME of the files are corrupt.  I'm currently using PKUNZIP v1.02 .
[...list of files & hosts deleted...]

It would be nice if the signatures for these were well known.
For example, each part of a distribution could have associated with it
a hunk of data consisting of signatures from the various checksumming
programs, say md4, md5, snefru, brik, etc.

This could also apply to the files contained within a distribution,
where a self-check could be administered at unpacking time.

Gene Kim and Gene Spafford at Purdue are currently betatesting a tool
called tripwire that accumulates
a database of signatures (including *all* the unix file system attributes).
This wouldn't be spoofproof, but when 2 parties disagree about the signature
of a file, or of a collection of files (which can be signatures or lists of
same), they can investigate further.  Publishing signatures of software
releases and distributions makes a lot of sense IMO!
-- 
kurt@grogatch.celestial.com (Kurt Cockrum)
 Nostalgic conservatives will soon be referring to the Bush Era as
 "those Halcion days of yesteryear".