This is the mail archive of the
gcc@gcc.gnu.org
mailing list for the GCC project.
why do many gcc mirrors not provide gunpg signatures?
- From: "alexofen at gmail dot com" <alexofen at gmail dot com>
- To: gcc at gcc dot gnu dot org
- Date: Sun, 27 Jan 2019 15:33:17 +0100
- Subject: why do many gcc mirrors not provide gunpg signatures?
Hello gnu :)
On https://gcc.gnu.org/mirrors.html it says "The archives there will be
signed by one of the following GnuPG keys", but most mirror ftp servers do
not provide any signatures to use those keys with.
It seems that some mirros provide the signatures (like
https://mirror.csclub.uwaterloo.ca/gnu/gcc/gcc-8.2.0/) and many others do
not (ftp://ftp.gwdg.de/pub/misc/gcc/releases/gcc-8.2.0/). why?
Should the mirrors not at least host the .sig files, considering that most
mirrors are http (not TLS/SSL) and the downloads can be MITM tampered?
best wishes
alex