Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] same version different sources

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Ladislav Hagara <ladislav.hagara AT unob.cz>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] same version different sources
  • Date: Mon, 22 May 2006 02:39:20 +0200


If upstream changes the tarball on us we should always check what changed
to be sure it's benign; if we see it's a bugfix we should probably
increment PATCHLEVEL when we fix the hash.
I used to be the main one reporting modified tarballs and auditing them,
which I did for two years until the cheap disk drive crashed.

I still have scripts I did to automate the audit weekly. Shall I set
them up again? It would be cool to integrate that into pm-seer so
everybody running prometheus would get a security-optimized (includes
file attributes from the tar and operates on binaries) diff output
as an attachment to the bug when the checksum failed.
That would be great.
Right now we don't always have a source tarball with the old hash, so
can't always compare. The above change had a diff attached to the bug,
but in many cases we have to ask upstream if the current tarball is
valid.

And what about "Vendor Signed Spells"?
We are not able to find out we use different sources. :-(

--
Ladislav Hagara





Archive powered by MHonArc 2.6.24.

Top of Page