Re: kernel.org status: hints on how to check your machine for intrusion

[H. Peter Anvin]

On 10/01/2011 03:43 PM, Willy Tarreau wrote:
> 
>   <version> <umask> <user> <group> <tag md5> <tar md5> <tar.gz md5> <status>
> 
> Since I can attest that I exclusively extracted the tarballs from the
> tar.gz and dumped their md5 at the same time, I'm pretty sure that the
> tar.gz's md5 is OK if the tar's md5 is OK. This will help speed up sig
> checks on mirrors.
> 

By the way, it's usually better to use sha256 or something else more
modern than MD5.

> All the times I got a different MD5 between the tarball and the git
> tag was because of a different user name in the tarball. It seems
> that old git versions used to use "git/git" instead of "root/root"
> now.

Yes, that change was introduced in git-1.5.0-rc1.

> This is hardcoded so it's not easy to change it, and I suspect
> that the tar format might have changed a bit, so if we want to check
> those MD5s, either we check on old mirrors that are 100% safe, or we
> have to reinstall an old version of git.

... or extract the tarball and diff the contents versus the git tree.

	-hpa
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/