From: Sam Gentle <sgentle@...>
Date: 2006-08-07T03:03:39+09:00
Subject: Re: remote require

On 8/6/06, Trans <transfire@gmail.com> wrote:
> Mat Schaffer wrote:
> > On Aug 3, 2006, at 1:05 PM, transfire@gmail.com wrote:
> > I think this would make a really nice gem.  I love the idea!  Maybe a
> > future revision could take a regular md5sum output file?
>
> I'll work on that. Also, someone else wrote me and suggested sha256
> instead of md5 for greater security -- good idea. I'm not sure how to
> generate the equivalent sha256 output file on my ubuntu box though, all
> I see is sha1sum.

I'd imagine your best bet here would be to use RSA or something
similar for signing. That way you'd just have to include a public key
in your remote_source definition and have the author of the module
provide signatures for each file. You could have different versions
with no troubles, provided they were appropriately signed.

Sam