<div><span style="color: rgb(160, 160, 168); ">On Monday, April 16, 2012 at 6:22 PM, "Martin v. Löwis" wrote:</span></div>
<blockquote type="cite" style="border-left-style:solid;border-width:1px;margin-left:0px;padding-left:10px;">
<span><div><div><blockquote type="cite"><div><div>fwiw Crate verifies the md5 hashes that the simple api gives for</div><div>each package. I think not doing that should be considered wrong.</div><div>(it's considered important for clients to check the checksum of</div><div>packages they download, but mirrors that are going to be </div><div>redistributing their files to clients this isn't important? Seems to</div><div>be a disconnect between the thoughts).</div></div></blockquote><div><br></div><div>I think this is a quality-of-implementation issue. They could verify</div><div>the md5; they could also verify the serversig. Some do, some don't.</div><div>Or they could claim they do but actually don't. Ultimately, clients</div><div>either need to trust the mirror, or do the verification themselves.</div></div></div></span></blockquote><div><span>Yea ultimately the clients will need to do the verification themselves, I</span></div><div>only meant to have somewhat more useful mirrors (corrupted data, bugs</div><div>in scripts, etc) it would make sense for mirrors to verify that the data they</div><div>are getting is the data they are expecting so they don't serve bad data. While</div><div>a verifying client won't be affected by that bad data, it does lower the overall</div><div>availability for that file.</div><blockquote type="cite" style="border-left-style:solid;border-width:1px;margin-left:0px;padding-left:10px;"><span><div><div><div><br></div><div>Regards,</div><div>Martin</div></div></div></span>
</blockquote>
<div>
<br>
</div>