signed gcc downloads

[Paul Koning]

>>>>> "Andrea" == Andrea 'Fyre Wyzard' Bocci <fwyzard@inwind.it> writes:

 Andrea> At 12:51 18/07/2002 +1200, Zach Bagnall wrote:
 >> Hi there. I'd really like to see the gcc releases distributed with
 >> a digital signature that can be verified. If the signatures are
 >> already available, I'd appreciate a link to their location.
 >> 
 >> All the best

 Andrea> Usually source distributions are MD5 signed - see the file
 Andrea> md5.sum in each directory. (eg.
 Andrea> ftp://ftp.mirror.ac.uk/sites/sources.redhat.com/pub/gcc/releases/gcc-3.1/md5.sum
 Andrea> for GCC 3.1).

Those aren't signatures, they are only checksums.  It isn't clear from
Zach's note which he's looking for -- the question depends on what
danger you want to protect against.

A simple MD5 checksum protects against data corruption in transit (TCP
checksum does the same, but not as well).  It does not protect against
tampering with the file because it's easy to post an md5.sum file
with corresponding changed checksums.

A signature (e.g., PGP signature) protects against tampering too, but
you need the signer's public key to check it, and it's more hassle to
apply since the signer has to supply his private key to do so.

      paul