[arch-general] Severity of Failed checksum for PKGBUILD

[Martti Kühne]

On Fri, Feb 20, 2015 at 3:53 PM, Mark Lee <mark at markelee.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> Checksums aren't sources, they are a method of verifying the integrity
> of sources. In other words, while different files can have the same
> md5sum (hash collision), a failed checksum indicates something has
> definitely changed in the package. Checksums can have false positives
> but not false negatives.
>
> In other words, the provided source is definitely not the same as the
> source the packager used (metadata difference in this case). If
> checksums are as useless as you claim, why even offer them if they
> cannot be reproduced for certain packages?
>
> Do packagers really just ignore checksums and "blindly update" on
> every release?
>
> Regards,
> Mark


I get your point.
Consider though, that Archlinux' comparably slim manpower cannot
account for every time upstream does things to their source tarballs,
usually in an unannounced manner. The concept is here, that ABS users
need to figure out themselves whether *their* sources are retrafficked
dns or the packager's. In so far as these things happen, they don't
even have to do with archlinux that much (it's not very nice of an
upstream to do that), so try not to bark up the wrong tree.

Cheers!
mar77i