Ensure Myrcon.* packages originate from official source

[phogue]

We can't do much about the id's of packages clashing when people have multiple repositories as source, but we can at least prevent people spoofing Myrcon package id's.

We should validate Myrcon.* packages originating from the set default feed and ignore any packages from other sources that begin with Myrcon.*

Since procon looks for Myrcon.Procon.Core to load up it will at least prevent a package being spoofed, the user adding the repository with it and then Procon updating with the new package, restarting and loading a dll in full trust from an untrusted source.

[m4cx]

why not signing them with a certificate and checking the signature?

2014-03-11 12:04 GMT+01:00 Geoff Green notifications@github.com:

We can't do much about the id's of packages clashing when people have
multiple repositories as source, but we can at least prevent people
spoofing Myrcon package id's.

We should validate Myrcon.* packages originating from the set default feed
and ignore any packages from other sources that begin with Myrcon.*

Since procon looks for Myrcon.Procon.Core to load up it will at least
prevent a package being spoofed, the user adding the repository with it and
then Procon updating with the new package, restarting and loading a dll in
full trust from an untrusted source.

Reply to this email directly or view it on GitHubhttps://github.com//issues/56
.