On Mon, Dec 08, 2008 at 07:08:20AM -0600, Dan McGee wrote: > We sign *packages*, not repositories. Will this damn thing about MD5 > please die? "Fixing" that still fixes nothing, and I'll pay one > million USD to someone that can actually forge a package with a given > MD5. Hah hah! I have my work ahead of me!