Public SourceMage Discussion List

[Arwed von Merkatz <v.merkatz AT gmx.net>]

On Fri, May 19, 2006 at 09:53:33AM -0700, seth AT swoolley.homeip.net wrote:
> On Fri, May 19, 2006 at 11:24:30AM -0500, Jeremy Blosser wrote:
> > On May 19, Ladislav Hagara [ladislav.hagara AT unob.cz] wrote:
> > > >
> > > > ==== //sgl/grimoires/devel/devel/tcl/DETAILS#8 (xtext) ====
> > > >
> > > > - 
> > > > SOURCE_HASH=sha512:f09e860a5c6408f32b8ce297d88952b8e670780eb5121b7e81b9db7e48a8b43899ad14eb31ad52d635dac71d46e2cec5db4361b4b44f6dcd5ba0d93741451fa8
> > > >
> > > > + 
> > > > SOURCE_HASH=sha512:2d89b21af314c1416747886873ef00478088b2bfcba4404c099a8dfb39737b8b6d29942376e9a0f9cfec9ecd6a09d0822b55b6ec2587e042acdcdebbef4b0d3c
> > > >
> > > >
> > > > ==== //sgl/grimoires/devel/devel/tcl/HISTORY#10 (text) ====
> > > >
> > > > +2006-05-19 Arwed v. Merkatz <v.merkatz AT gmx.net>
> > > >
> > > > + * DETAILS: fixed SOURCE_HASH, bug #11553
> > > >
> > > 
> > > Just small idea/problem I have thought several times.
> > > 
> > > Now different users have different sources.
> > > 
> > > If new sources fix some problem users using old sources still have that 
> > > problem.
> > > 
> > > Two users with the same version of spell can have applications with 
> > > different behaviour.
> > > 
> > > What about something like "summon -f" for all users with old sources?
> > 
> > If upstream changes the tarball on us we should always check what changed
> > to be sure it's benign; if we see it's a bugfix we should probably
> > increment PATCHLEVEL when we fix the hash.
> 
> I used to be the main one reporting modified tarballs and auditing them,
> which I did for two years until the cheap disk drive crashed.
> 
> I still have scripts I did to automate the audit weekly.  Shall I set
> them up again?  It would be cool to integrate that into pm-seer so
> everybody running prometheus would get a security-optimized (includes
> file attributes from the tar and operates on binaries) diff output
> as an attachment to the bug when the checksum failed.
 
That would be great.
Right now we don't always have a source tarball with the old hash, so
can't always compare. The above change had a diff attached to the bug,
but in many cases we have to ask upstream if the current tarball is
valid.

-- 
Arwed v. Merkatz                              Source Mage GNU/Linux developer
                                                    http://www.sourcemage.org