Skip to Content.
Sympa Menu

sm-commit - Re: [SM-Commit] GIT changes to master grimoire by Ladislav Hagara (ad0a24226e43aeb1ac12e792c02e31f3011852c4)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Ladislav Hagara <ladislav.hagara AT unob.cz>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: Re: [SM-Commit] GIT changes to master grimoire by Ladislav Hagara (ad0a24226e43aeb1ac12e792c02e31f3011852c4)
  • Date: Fri, 11 May 2007 10:07:14 +0200

> GIT changes to master grimoire by Ladislav Hagara
> <ladislav.hagara AT unob.cz>:
>> x11-toolkits/wxgtk/DETAILS | 2 +-
>> x11-toolkits/wxgtk/HISTORY | 3 +++
>> 2 files changed, 4 insertions(+), 1 deletion(-)
>>
>> New commits:
>> commit ad0a24226e43aeb1ac12e792c02e31f3011852c4
>> Author: Ladislav Hagara <ladislav.hagara AT unob.cz>
>> Commit: Ladislav Hagara <ladislav.hagara AT unob.cz>
>>
>> wxgtk: updated SOURCE_HASH for 2.8.3
>>
>> please, could you check it by "summon -d wxgtk", "sha512sum
>> wxGTK-2.8.3.tar.bz2"
>> seems sources have been changed
>
> You should ask for someone with the file with the old hash first, before
> changing the hash in the file. That way the files can be checked for
> malicious changes. If you just update the hash without check, having the
> hash isn't very useful in the first place.


Yea, good theory. I also would like to see the diff file.
In reality I can only submit bug report and wait weeks.
It is "only" test grimoire. All developers should read SM-Commit list
and I hoped that someone with old sources just checked it.
Moreover I asked for it. Nobody did it. I am sorry I haven't old
sources. I can't do it.
There is no problem to revert my change if it is my fault.

Only to mention we still do not check sources signed by vendors.
Users can use different sources and we still ignore this!
If vendor changes sources we find out it by our hash or by our own
signature.
If vendor changes sources and also changes signature we do not discover it!
Besides sources and signatures can be changed by some hacker/cracker
(not only theoretical, do not remeber problems with GNU archive?).
It is our big problem and we still ignore it. :-(

--
Ladislav Hagara



>> VERSION=2.8.3
>> -
>> SOURCE_HASH=sha512:2ca549d91acfb5a96e291d8b79112eee06664f99d79cd603cfeb8a42a5cec631c0c05e46d58793ba938ace39d953ce15b5e4aa1ada1b225422dd6c4c839d0ac1
>> +
>> SOURCE_HASH=sha512:0e88e32f924ad2b330eb960503553ee8dfaf9336b8f075d038872ee6f26539e623c9ff62e159c29d456c3641ee590ca002287d744981349826fb78cb1d8346a7
>> else
>>
>> +++ b/x11-toolkits/wxgtk/HISTORY
>> @@ -1,3 +1,6 @@
>> +2007-05-10 Ladislav Hagara <hgr AT vabo.cz>
>> + * DETAILS: updated SOURCE_HASH for 2.8.3




Archive powered by MHonArc 2.6.24.

Top of Page