Re: Creating a PEAR mirror
| From: | Tim Jackson | Date: | Tue, 22 Jul 2008 08:10:19 +0000 |
| Subject: | Re: Creating a PEAR mirror | ||
| References: | 1 2 | Groups: | php.pear.dev |
| Request: | Send a blank email to pear-dev+get-50434@lists.php.net to get a copy of this message | ||
Christian Weiske wrote:
It seems that most of the problems (policy, security, auto-discovery etc.) are unique to public mirrors though? An rsync source is all that's required for a private mirror.c) Would a private mirror be OK, or only one that was publically accessible?Since we don't have a procedure to handle public mirrors, private ones are even more away :/
However, first we have to solve some problems including how to make sure mirrors are white ones, e.g. http://www.heise-online.co.uk/news/Linux-package-management-systems-not-completely-secure--/111103Again, this only applies to public mirrors really. There are other problems implicit in that for PEAR too, like signing of packages (not routinely done), signing of metadata (I'm not sure this is even possible in PEAR) etc. Tim