[Rpm-maint] [rpm-software-management/rpm] RPM with Copy on Write (#1470)

Wed Dec 30 01:07:45 UTC 2020

How will package signatures be verified?  More specifically, will `rpm2extents` verify the signed digest of files before decompressing them?  Otherwise, this seems like a potential security risk, in case there is a bug in the decompression library.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/1470#issuecomment-752292624
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20201229/b927565c/attachment.html>