Re: same filename but different checksum

On Fri, 20 Feb 2004, Daniel Stone wrote:

> > I noticed that a few packages that were previously available for download
> > (in dist/ directory) were changed when now available from release/
> > directory.
> >
> > Same filenames but different checksums.
> >
> > This breaks automated build systems that verify the integrity of the
> > source downloads before using them.
> >
> > In the future please consider either using new filename for the official
> > release or maybe better to use a different filename for the "various
> > tarballs which aren't really ready for release" -- maybe by adding
> > "-beta1" etc.
>
> Can you please elaborate on which tarballs changed md5sums?

libXres
libXv
randrext
(and maybe others)

I am away from my office and away from my workstation so it is hard for me
to copy and paste all the SHA1 checksums and filenames.

By the way, autobuild systems include Gentoo Linux and FreeBSD ports and
NetBSD pkgsrc. They are all useful for finding potentially trojaned
source. If I recall correctly, this is how a trojan of sendmail was
found over a year ago.


   Jeremy C. Reed
   http://bsd.reedmedia.net/