Re: [blfs-support] protobuf-33.0

Am 17.10.25 um 21:44 schrieb Rahul Chandra ([email protected] via
blfs-support Mailing List):
> On Fri, Oct 17, 2025 at 9:00 AM Bruce Dubbs
> <[email protected]> wrote:
>>
>> I updated to protobuf-33.0 yesterday, but checking md5sums today I found that
>> upstream made a 'stealth' update.  That is, they changed the tarball without changing
>> the version number.
>>
>> One file was changed.
>>
>> I've updated the book, but it will not render until early tomorrow morning.
>>
>> The updated md5sum is 936b48fdf816b0341c74ba73a42348c0.  Nothing else changed.
> 
> 
> I can't seem to find the original file but if you still have it can
> you extract and diff -Naur them, might just be my paranoia talking but
> we don't want to end up with another xz scenario. If that's what you
> meant by nothing else changed then ignore this message.
Paranoia is not always bad.  Andy Grove once put it this way: "Only the
paranoid survive."  Intel should have heeded that.

Anyway - I share your qualms about this incident and I'm a bit appalled
how something like this seems to be just shrugged off in this thread.
Especially given the xz-disaster and the horrendous threat-situation of
today.

Creditably, one user, Adrian Ho, actually bothered to ask the developers
for an explanation and so at least made them aware that this did not go
unnoticed: https://groups.google.com/g/protobuf/c/JnT34gSlL2k

I find the developer's reply unsatisfactory, as it lacks an apology and
an assurance that this won't happen again in the future.  Fortunately, I
don't need "protobuf".

Rainer

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-dev
Unsubscribe: See the above information page