Skip to Content.
Sympa Menu

sm-commit - Re: [SM-Commit] GIT changes to master grimoire by Ethan Grammatikidis (39a87057bddd3a4868320335abd28b40726dc6c3)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Remko van der Vossen <wich AT stack.nl>
  • To: Ethan Grammatikidis <eekee57 AT fastmail.fm>
  • Cc: sm-commit AT lists.ibiblio.org
  • Subject: Re: [SM-Commit] GIT changes to master grimoire by Ethan Grammatikidis (39a87057bddd3a4868320335abd28b40726dc6c3)
  • Date: Wed, 16 Jan 2008 15:38:46 +0100

On Wed, Jan 16, 2008 at 02:26:44PM +0000, Ethan Grammatikidis wrote:
> On Wed, 16 Jan 2008 14:57:52 +0100
> Jaka Kranjc <lynx AT mages.ath.cx> wrote:
> > > hexedit: changed SOURCE_HASH to match current download
> > Is this safe?
>
> Not sure really, except that I figure it's about as safe as signing a new
> tarball with a sha512.

No, this defeats the purpose of having hashes, when you have a new
tarball you know it's a new release and the person adding the spell will
have cast it and will have checked that it doesn't do very wicked
things.

Now, as assume you have cast it with the new tarball and hash, and have
checked that it doesn't do anything very strange. But all the same,
check a diff of the old tarball and the new if you have both available
and check if there are any strange things going on, alternatively check
with upstream whether they have altered the tarball without making a new
release, which you would normally expect. Note in HISTORY that you have
checked with upstream and if possible note consicely why upstream
changed the tarball.

You can see it like this, we only change the hash when we are notified
by upstream that they have changed the tarball, by making a new release
they notify us implicitly.

Remko van der Vossen

Attachment: smime.p7s
Description: S/MIME cryptographic signature




Archive powered by MHonArc 2.6.24.

Top of Page