Public SourceMage Discussion List

[Ladislav Hagara <ladislav.hagara AT unob.cz>]

> > > If upstream changes the tarball on us we should always check what 
> > > changed
> > > to be sure it's benign; if we see it's a bugfix we should probably
> > > increment PATCHLEVEL when we fix the hash.
> > I used to be the main one reporting modified tarballs and auditing them,
> > which I did for two years until the cheap disk drive crashed.
> >
> > I still have scripts I did to automate the audit weekly. Shall I set
> > them up again? It would be cool to integrate that into pm-seer so
> > everybody running prometheus would get a security-optimized (includes
> > file attributes from the tar and operates on binaries) diff output
> > as an attachment to the bug when the checksum failed.
> That would be great.
> Right now we don't always have a source tarball with the old hash, so
> can't always compare. The above change had a diff attached to the bug,
> but in many cases we have to ask upstream if the current tarball is
> valid.

And what about "Vendor Signed Spells"?
We are not able to find out we use different sources. :-(

--
Ladislav Hagara