From: Trans <transfire@...>
Date: 2006-08-07T20:40:05+09:00
Subject: Re: remote require


Sam Gentle wrote:
> On 8/6/06, Trans <transfire@gmail.com> wrote:
> > Mat Schaffer wrote:
> > > On Aug 3, 2006, at 1:05 PM, transfire@gmail.com wrote:
> > > I think this would make a really nice gem.  I love the idea!  Maybe a
> > > future revision could take a regular md5sum output file?
> >
> > I'll work on that. Also, someone else wrote me and suggested sha256
> > instead of md5 for greater security -- good idea. I'm not sure how to
> > generate the equivalent sha256 output file on my ubuntu box though, all
> > I see is sha1sum.
>
> I'd imagine your best bet here would be to use RSA or something
> similar for signing. That way you'd just have to include a public key
> in your remote_source definition and have the author of the module
> provide signatures for each file. You could have different versions
> with no troubles, provided they were appropriately signed.

I'm not as sure, albeit I'm not experienced enough to to certain. Could
you eleborate on how it would work? When you say signitures for each
file what are we takling about exactly?

Thanks,
T.


> Sam