Security bugs are reported here via bugzilla

["Sergey A. Lipnevich" <sergey AT optimaltec.com>]

Seth Woolley wrote:

> 1) 40 sources or just use regular MD5s. (two for each source, one for the
> original file, second for the detached signature).
> For the ones with lots of patches, when you add gpg to it, you just
> renumber them 1, 2, 3 would be 1, 3, 5 with 2, 4, 6 being the respective
> signature files.

This will get us nowhere. It's not that your idea is faulty, it's that 
entire MD5[x] business. It ould be better to use some variable, say 
VERIFY, with a predefined format which would be, say, MD5:576576...78576 
or something lese for the GPG., like GPG:URL-of-the-signature.

> 2) all MD5 sources that choose not to use gpg checking will require no
> modifications.  For those that do provide gpg signatures, you just do what
> I said in answer 1), and then make sure that the additional args are
> passed to unpack as $3 and $4.
>
>
> would look like:
>
> ==>
> unpack $SOURCE  ${MD5[0]}  $SOURCE2  ${MD5[1]}  &&
> unpack $SOURCE3 ${MD5[2]}  $SOURCE4  ${MD5[3]}
> <==

Again, it's not your fault, but doesn't this indexing look like asking 
for trouble more than anything else?

I think we need not rush into this and maybe rethink the MD5 idea better.

Sergey.