[arch-general] Severity of Failed checksum for PKGBUILD

[Daniel Micay]

On 20/02/15 10:04 AM, Martti Kühne wrote:
> On Fri, Feb 20, 2015 at 3:53 PM, Mark Lee <mark at markelee.com> wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA256
>>
>> Checksums aren't sources, they are a method of verifying the integrity
>> of sources. In other words, while different files can have the same
>> md5sum (hash collision), a failed checksum indicates something has
>> definitely changed in the package. Checksums can have false positives
>> but not false negatives.
>>
>> In other words, the provided source is definitely not the same as the
>> source the packager used (metadata difference in this case). If
>> checksums are as useless as you claim, why even offer them if they
>> cannot be reproduced for certain packages?
>>
>> Do packagers really just ignore checksums and "blindly update" on
>> every release?
>>
>> Regards,
>> Mark
> 
> 
> I get your point.
> Consider though, that Archlinux' comparably slim manpower cannot
> account for every time upstream does things to their source tarballs,
> usually in an unannounced manner. The concept is here, that ABS users
> need to figure out themselves whether *their* sources are retrafficked
> dns or the packager's. In so far as these things happen, they don't
> even have to do with archlinux that much (it's not very nice of an
> upstream to do that), so try not to bark up the wrong tree.
> 
> Cheers!
> mar77i

You should really just tell upstream to sign their releases, because it
wipes out the attack vector instead of just making it possible to audit
whether a MITM attack on the original. packager occurred like hashes.

The hashes provide no security for the initial packaging work and no
defense against an attack that's done by compromising the upstream
sources, which is far more realistic than a targeted MITM attack on a
specific Arch Linux packager.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-general/attachments/20150220/ec1256bb/attachment.asc>