Re: CGI scripts on www.octave.org broken

[John W. Eaton]

On 31-Mar-2004, Steve Lipa <address@hidden> wrote:

| This might be a good time to consider providing a detached gpg signature
| file for Octave and octave-forge tarballs.  This could help reduce the
| fallout from a rootkit.  I know it would give me a warm fuzzy feeling.

The public web and ftp server only mirrors the real source for the
content.  The files on the new server were copied from the real source
which was not compromised.  Of course, this would not help much if the
system which is the real source of the files had been compromised, but
in this case, I don't think there is any problem with the files on the
new server.

I'm willing to provide additional ways to ensure the integrity of the
files on the Octave site, but someone else will have to provide
step-by-step instructions for what to do.  For various reasons, I
don't have much time to spend working on this task now.

jwe