Re: CVE for Kali Linux

[Florian Weimer <fw () deneb enyo de>]

* Kurt Seifried:

> So I guess we enter uncharted territory here.

No, this is pretty much the same as bug 998:

  <https://bugzilla.redhat.com/show_bug.cgi?id=998>

Here's one non-working attempt at solving this with the Microsoft
trust root:

  <https://fedoraproject.org/wiki/Features/PackageSignatureCheckingDuringOSInstall>

(It does not work because anyone can have binaries signed under the
Microsoft trust root.)

> Vendor has front page that recommends doing something completely
> insane and insecure (http/md5s/etc.).

Please tone down your language, it's not constructive at all.