Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] same version different sources

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Arwed von Merkatz <v.merkatz AT gmx.net>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] same version different sources
  • Date: Fri, 19 May 2006 19:03:52 +0200

On Fri, May 19, 2006 at 09:53:33AM -0700, seth AT swoolley.homeip.net wrote:
> On Fri, May 19, 2006 at 11:24:30AM -0500, Jeremy Blosser wrote:
> > On May 19, Ladislav Hagara [ladislav.hagara AT unob.cz] wrote:
> > > >
> > > > ==== //sgl/grimoires/devel/devel/tcl/DETAILS#8 (xtext) ====
> > > >
> > > > -
> > > > SOURCE_HASH=sha512:f09e860a5c6408f32b8ce297d88952b8e670780eb5121b7e81b9db7e48a8b43899ad14eb31ad52d635dac71d46e2cec5db4361b4b44f6dcd5ba0d93741451fa8
> > > >
> > > > +
> > > > SOURCE_HASH=sha512:2d89b21af314c1416747886873ef00478088b2bfcba4404c099a8dfb39737b8b6d29942376e9a0f9cfec9ecd6a09d0822b55b6ec2587e042acdcdebbef4b0d3c
> > > >
> > > >
> > > > ==== //sgl/grimoires/devel/devel/tcl/HISTORY#10 (text) ====
> > > >
> > > > +2006-05-19 Arwed v. Merkatz <v.merkatz AT gmx.net>
> > > >
> > > > + * DETAILS: fixed SOURCE_HASH, bug #11553
> > > >
> > >
> > > Just small idea/problem I have thought several times.
> > >
> > > Now different users have different sources.
> > >
> > > If new sources fix some problem users using old sources still have that
> > > problem.
> > >
> > > Two users with the same version of spell can have applications with
> > > different behaviour.
> > >
> > > What about something like "summon -f" for all users with old sources?
> >
> > If upstream changes the tarball on us we should always check what changed
> > to be sure it's benign; if we see it's a bugfix we should probably
> > increment PATCHLEVEL when we fix the hash.
>
> I used to be the main one reporting modified tarballs and auditing them,
> which I did for two years until the cheap disk drive crashed.
>
> I still have scripts I did to automate the audit weekly. Shall I set
> them up again? It would be cool to integrate that into pm-seer so
> everybody running prometheus would get a security-optimized (includes
> file attributes from the tar and operates on binaries) diff output
> as an attachment to the bug when the checksum failed.

That would be great.
Right now we don't always have a source tarball with the old hash, so
can't always compare. The above change had a diff attached to the bug,
but in many cases we have to ask upstream if the current tarball is
valid.

--
Arwed v. Merkatz Source Mage GNU/Linux developer
http://www.sourcemage.org




Archive powered by MHonArc 2.6.24.

Top of Page