Public SourceMage Discussion List

[seth AT swoolley.homeip.net]

On Fri, May 19, 2006 at 11:24:30AM -0500, Jeremy Blosser wrote:
> On May 19, Ladislav Hagara [ladislav.hagara AT unob.cz] wrote:
> > >
> > > ==== //sgl/grimoires/devel/devel/tcl/DETAILS#8 (xtext) ====
> > >
> > > - 
> > > SOURCE_HASH=sha512:f09e860a5c6408f32b8ce297d88952b8e670780eb5121b7e81b9db7e48a8b43899ad14eb31ad52d635dac71d46e2cec5db4361b4b44f6dcd5ba0d93741451fa8
> > >
> > > + 
> > > SOURCE_HASH=sha512:2d89b21af314c1416747886873ef00478088b2bfcba4404c099a8dfb39737b8b6d29942376e9a0f9cfec9ecd6a09d0822b55b6ec2587e042acdcdebbef4b0d3c
> > >
> > >
> > > ==== //sgl/grimoires/devel/devel/tcl/HISTORY#10 (text) ====
> > >
> > > +2006-05-19 Arwed v. Merkatz <v.merkatz AT gmx.net>
> > >
> > > + * DETAILS: fixed SOURCE_HASH, bug #11553
> > >
> > 
> > Just small idea/problem I have thought several times.
> > 
> > Now different users have different sources.
> > 
> > If new sources fix some problem users using old sources still have that 
> > problem.
> > 
> > Two users with the same version of spell can have applications with 
> > different behaviour.
> > 
> > What about something like "summon -f" for all users with old sources?
> 
> If upstream changes the tarball on us we should always check what changed
> to be sure it's benign; if we see it's a bugfix we should probably
> increment PATCHLEVEL when we fix the hash.

I used to be the main one reporting modified tarballs and auditing them,
which I did for two years until the cheap disk drive crashed.

I still have scripts I did to automate the audit weekly.  Shall I set
them up again?  It would be cool to integrate that into pm-seer so
everybody running prometheus would get a security-optimized (includes
file attributes from the tar and operates on binaries) diff output
as an attachment to the bug when the checksum failed.

Seth