Dear misc, To my knowledge OpenBSD packages aren't signed, but it would be a good practice, IMHO. For example, it would help against tampering (e.g the OpenSSH trojan that happened a while ago), man-in-middle attacks against user, etc. I do trust the packages that are on the CDs, but as space is limited, you can't put all of them there.
Of course, it wouldn't help to prevent all attacks imaginable, we have to trust machines where the packages are built on (but why wouldn't we?). Simply running mtree (with sha1/md5/ripemd) over the package tree before uploading them to ftp, and putting the output file on the CD would help. There could be problems with -stable packages, but it may be possible to mitigate them by gzsig(1)-ing the packages (with the keys that are to be put on the CDs). What are your thoughts on this subject? Madars
