Re: [blfs-support] protobuf-33.0

On 10/18/25 4:31 AM, Rainer Fiebig ([email protected] via blfs-dev Mailing List) wrote:
> Am 17.10.25 um 21:44 schrieb Rahul Chandra ([email protected] via
> blfs-support Mailing List):
>> On Fri, Oct 17, 2025 at 9:00 AM Bruce Dubbs
>> <[email protected]> wrote:
>>>
>>> I updated to protobuf-33.0 yesterday, but checking md5sums today I found that
>>> upstream made a 'stealth' update.  That is, they changed the tarball without changing
>>> the version number.
>>>
>>> One file was changed.
>>>
>>> I've updated the book, but it will not render until early tomorrow morning.
>>>
>>> The updated md5sum is 936b48fdf816b0341c74ba73a42348c0.  Nothing else changed.
>>
>>
>> I can't seem to find the original file but if you still have it can
>> you extract and diff -Naur them, might just be my paranoia talking but
>> we don't want to end up with another xz scenario. If that's what you
>> meant by nothing else changed then ignore this message.
> Paranoia is not always bad.  Andy Grove once put it this way: "Only the
> paranoid survive."  Intel should have heeded that.
> 
> Anyway - I share your qualms about this incident and I'm a bit appalled
> how something like this seems to be just shrugged off in this thread.

It wasn't just shrugged off in this thread.  I found the problem a day after I 
updated the book to version 33.0. It is a part of our QA process.

I checked it out and found it not harmful.  I then updated the book for the change 
and made an announcement here.

> Especially given the xz-disaster and the horrendous threat-situation of
> today.
> 
> Creditably, one user, Adrian Ho, actually bothered to ask the developers
> for an explanation and so at least made them aware that this did not go
> unnoticed: https://groups.google.com/g/protobuf/c/JnT34gSlL2k
> 
> I find the developer's reply unsatisfactory, as it lacks an apology and
> an assurance that this won't happen again in the future.  Fortunately, I
> don't need "protobuf".

Yes, the reply was a bit weak.

   -- Bruce

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-dev
Unsubscribe: See the above information page