RPM submission procedure

[Enrico Scholz]

esr at thyrsus.com ("Eric S. Raymond") writes:

>> Something like how I started this Bugzilla report is one way packages 
>> are submitted.  Only the URL to SRPM, URL to md5sums.asc, and a short 
>> description about what the package does.
> ...
>
> (2) Don't RPMs have their own internal checksum?

Yes, they have but we request the md5sums because of security reasons:
hostile packager could replace the package with a malicious version
after a successful review.

The buildsystem verifies actual and expected MD5sum to prevent this kind
of attack.



Enrico