Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] same version different sources

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: seth AT swoolley.homeip.net
  • To: Ladislav Hagara <ladislav.hagara AT unob.cz>
  • Cc: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] same version different sources
  • Date: Sun, 21 May 2006 20:16:18 -0700

On Mon, May 22, 2006 at 02:39:20AM +0200, Ladislav Hagara wrote:
> >
> >>> If upstream changes the tarball on us we should always check what
> >>> changed
> >>> to be sure it's benign; if we see it's a bugfix we should probably
> >>> increment PATCHLEVEL when we fix the hash.
> >> I used to be the main one reporting modified tarballs and auditing them,
> >> which I did for two years until the cheap disk drive crashed.
> >>
> >> I still have scripts I did to automate the audit weekly. Shall I set
> >> them up again? It would be cool to integrate that into pm-seer so
> >> everybody running prometheus would get a security-optimized (includes
> >> file attributes from the tar and operates on binaries) diff output
> >> as an attachment to the bug when the checksum failed.
> > That would be great.
> > Right now we don't always have a source tarball with the old hash, so
> > can't always compare. The above change had a diff attached to the bug,
> > but in many cases we have to ask upstream if the current tarball is
> > valid.
>
> And what about "Vendor Signed Spells"?
> We are not able to find out we use different sources. :-(

summon -d fixes this issue, but it can be made to be automatically
retried on a vendor-signed source if you file a bug and assign it to me.


In fact, summon -d could detect that a certain source is a signature of
another spell and force redownload the signature on every summon, where
if it detected a difference it could resummon the original source that
it intends to sign. This allows websites to update an upstream source
gracefully. If the PGP process is compromised _it is and always will be
out of our hands_ unless you know of another suggestion.

(configured as an optional feature in the sorcery menu, too, so you can
still get the older more paranoid behavior.)

Also, as has been said before, you can include the vendor's signature
locally in the spell if you are worried about the security of a vendor
signature. If you are so concerned you can sign it yourself or hash it
yourself if you are the guru. You can also set your own verification
settings in sorcery to not accept vendor signatures if you so desire, if
you are the end user.

We allow so many ways to verify things, can you be happy with what
you've got?




Archive powered by MHonArc 2.6.24.

Top of Page