Re: Introducing NewStuffManager

[Sebastian Pölsterl <marduk k-d-w org>]

Andrew Sobala wrote:
>
> Hi Sebastian,
>
> I missed Nigel's original e-mail, and on reading it now, I think an
> extension downloading and applying mechanism is needed in GNOME. Thanks
> loads for working on this, you rock :-)
>
Thanks a lot!

> I haven't looked at the presentation in too much depth, but in Nigel's
> original e-mail, he mentions there's no security. What's the status on
> this - have you implemented GPG signing now, or are you still planning
> on doing so in the future? I do think any extension mechanism nowadays
> is absolutely worthless until we can verify that the code came from a
> trusted source.
>
GPG support is on my todo list. Currently, you can only provide a checksum
(md5 or sha1) and NewStuffManager verifies the downloaded file.

-- 
Greetings,
Sebastian Pölsterl