Re: [arch-general] [arch-dev-public] Can we trust our mirrors?

Gerhard Brauer schrieb:

For myself i don't accept the "md5sum is bad" argument as a "stopper" for each idea to provide a pacman secure concept ;-)

I wasn't going to stop you. Signed db files are an important first step. My point is that it was often suggested to move from md5 to something more secure. This suggestion was always rejected because we never used md5 for security. If we are going to implement your suggestion (and I vote that we do), we should really consider a better hash!