Skip to Content.
Sympa Menu

sm-grimoire - Re: [SM-Grimoire] (no subject)

sm-grimoire AT lists.ibiblio.org

Subject: Discussion of Spells and Grimoire items

List archive

Chronological Thread  
  • From: Seth Woolley <seth AT tautology.org>
  • To: "Julian v. Bock" <julian AT openit.de>
  • Cc: sm-grimoire AT lists.ibiblio.org
  • Subject: Re: [SM-Grimoire] (no subject)
  • Date: Fri, 31 Jan 2003 03:20:07 -0800 (PST)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Fri, 31 Jan 2003, Julian v. Bock wrote:

> Hi
>
> >>>>> "JvB" == Julian v Bock <julian AT openit.de> writes:
> >>>>> "SW" == Seth Woolley <seth AT tautology.org> writes:
>
> SW> I updated a whole bunch of md5s in devel and test. p4 sync up
> SW> everybody (developers) and make sure I didn't royally screw
> SW> anything up.
>
> JvB> I hope you didn't just update without checking if they didn't
> JvB> match. if the yare just updated they don't make any sense.
>
> I should read what I write.
> Here the corrected sentence:
>
> I hope you didn't just update without checking whether the old md5
> worked (someone forgot to update the md5sum). Otherwise the md5 might
> have changed because of a compromise.
>

I kinda answered this in my other email, but you reminded me of the "old"
way md5s were done accidentally.

You know, the supposed big mistake with md5s was that they were being done
inappropriately, on the compressed source instead of uncompressed.

I only saw _one_ file like that, and they caught that themselves within a
day, without my telling them about it.

My auditor checks for that specifically (called MALFORMED).

The vast majority of wrong md5s were in unversioned source filenames,
where the filename stayed the same but the authors modified it. I keep
backups of all my resummons, so I see those as "DIFFERENT" with a MATCHES
clause that tells me which other file in my cache it matches.

But back to your question. I provided reports to every section back in
october of which spells didn't match through bugzilla. Since then we went
from 1/3 bad to 1/20 bad. The rest are mostly strange circumstances, like
they md5'd the wrong tarball (kdegraphics and kdegames were mixed up, for
example) or made some other mistake. A lot were that we ddn't have an
IGNORE keyword to tag CVS or nightly spells. The kernel spell was almost
infeasable until gpg checking as added to it (fixing that was fun).

In order to make it even more difficult to trojan stuff, the security team
wants to allow spell authors to do gpg checking of spells similar to the
way the linux kernel spell does it, where 90% of the trust is on the
author instead of on our infallible selves. This would be an either/or
thing where md5s would be a fallback, but we think this would make
upgrades so much easier in the long run that spell authors would want to
do this. The entire KDE section, for example, could rely on one key, the
kde public key, making version bumps tons easier.

But all in all, the current system is working fine the way it is, and will
only get better.

Seth

- --
Seth Alan Woolley <seth at tautology.org>, SPAM/UCE is unauthorized
Key id 7BEACC7D = 2978 0BD1 BA48 B671 C1EB 93F7 EDF4 3CDF 7BEA CC7D
Full Key at seth.tautology.org, see www.gnupg.org www.keyserver.net
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.0 (FreeBSD)

iD8DBQE+Olvq7fQ833vqzH0RAp8gAKDSf276dnbpb5jgNRNEAt9hUtpk7gCg1t+4
XILz0dIZhJyCgHS5bH2Ew60=
=wm4I
-----END PGP SIGNATURE-----





Archive powered by MHonArc 2.6.24.

Top of Page