Re: VLC missing chain of trust
On 07/05/2017 10:33 AM, Sérgio Basto wrote:
Germano ,
Are you simple request https on rpm spec ? or something else ? for
that you just need make one pull request via github for example ...
I think he is
concerned that you might have downloaded the source using
http instead of https. That concern is easy to check by downloading the
source via https and comparing the hash of the source in the rpm.
A worse problem is that by default, vlc redirects to mirrors, that do
not all use https, and the nightly versions are not signed. So he is
suggesting that Fedora not use nightly versions - as there is not an
easy chain of trust. However, the chain of trust can still be checked
by manually downloading via https and not using a mirror.
On Tue, 2017-07-04 at 18:33 +0200, Germano Massullo wrote:
> VLC package shipped by RPMFusion is missing a chain of trust with
> upstream developers.
> As exhaustively explained by Fabio Pietrosanti (naif) at VLC bugreport
> [1], upstream has the bad habit to ship VLC using http instead of https.