Re: [SCRIPT] Generate SHA256SUM files for the mirror

["Daniel Shahaf" <d.s@xxxxxxxxxxxxxxxxxx>]

We might want to have rsyncd.conf exclude MD5SUM and SHA256SUM (and possibly *.asc) from the "pub" dataset, thus forcing people to download them from *.zsh.org directly.  This would mean an active attacker with root access to a mirror wouldn't be able to "just" replace the .tar.xz file and recalculate the checksums; they'd have to collide the SHA256 checksum (and possibly forge a signature under the true key) as well.