Skip to Content.
Sympa Menu

sm-commit - Re: [SM-Commit] GIT changes to master grimoire by Ladislav Hagara (ad0a24226e43aeb1ac12e792c02e31f3011852c4)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: seth AT swoolley.homeip.net
  • To: Ladislav Hagara <ladislav.hagara AT unob.cz>
  • Cc: sm-commit AT lists.ibiblio.org
  • Subject: Re: [SM-Commit] GIT changes to master grimoire by Ladislav Hagara (ad0a24226e43aeb1ac12e792c02e31f3011852c4)
  • Date: Fri, 11 May 2007 04:10:33 -0700

On Fri, May 11, 2007 at 10:07:14AM +0200, Ladislav Hagara wrote:
> > GIT changes to master grimoire by Ladislav Hagara
> > <ladislav.hagara AT unob.cz>:
> >> x11-toolkits/wxgtk/DETAILS | 2 +-
> >> x11-toolkits/wxgtk/HISTORY | 3 +++
> >> 2 files changed, 4 insertions(+), 1 deletion(-)
> >>
> >> New commits:
> >> commit ad0a24226e43aeb1ac12e792c02e31f3011852c4
> >> Author: Ladislav Hagara <ladislav.hagara AT unob.cz>
> >> Commit: Ladislav Hagara <ladislav.hagara AT unob.cz>
> >>
> >> wxgtk: updated SOURCE_HASH for 2.8.3
> >>
> >> please, could you check it by "summon -d wxgtk", "sha512sum
> >> wxGTK-2.8.3.tar.bz2"
> >> seems sources have been changed
> >
> > You should ask for someone with the file with the old hash first, before
> > changing the hash in the file. That way the files can be checked for
> > malicious changes. If you just update the hash without check, having the
> > hash isn't very useful in the first place.
>
>
> Yea, good theory. I also would like to see the diff file.
> In reality I can only submit bug report and wait weeks.
> It is "only" test grimoire. All developers should read SM-Commit list
> and I hoped that someone with old sources just checked it.
> Moreover I asked for it. Nobody did it. I am sorry I haven't old
> sources. I can't do it.
> There is no problem to revert my change if it is my fault.
>
> Only to mention we still do not check sources signed by vendors.
> Users can use different sources and we still ignore this!
> If vendor changes sources we find out it by our hash or by our own
> signature.
> If vendor changes sources and also changes signature we do not discover it!
> Besides sources and signatures can be changed by some hacker/cracker
> (not only theoretical, do not remeber problems with GNU archive?).
> It is our big problem and we still ignore it. :-(

Sources and signatures cannot be changed by hacker/cracker because the
signature is validated by the public key of the author.

That's the entire point. The GNU archive problem was not a big deal
because they did have signatures on most of the data.

Seth




Archive powered by MHonArc 2.6.24.

Top of Page