Updated patch, which assumes the libdebian-installer4-dev package will
not be renamed. Build-Depend on a recent enough version that provides
sha256 fields.
Regards,
--
Steven Chamberlain
ste...@pyro.eu.org
diff --git a/debian/changelog b/debian/changelog
index d6682ca..20e33a0 100644
--- a/debia
Processing control commands:
> tags -1 + patch
Bug #856211 [src:anna] anna: please implement SHA256 verification of .udeb files
Added tag(s) patch.
--
856211: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=856211
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
Control: tags -1 + patch
Hi,
Attached is a minimal patch intended to implement SHA256 verification.
It would depend on libdebian-installer being patched first (#856210) and
bumping the soname to 5.
"#define SHA256_HEX_LENGTH 64" is made explicit as possible so that one
remembers to increase it i
Steven Chamberlain wrote:
> Attached is [...]
Regards,
--
Steven Chamberlain
ste...@pyro.eu.org
diff --git a/anna.c b/anna.c
index 4b68816..e03d34a 100644
--- a/anna.c
+++ b/anna.c
@@ -318,8 +318,8 @@ install_modules(di_packages *status, di_packages *packages) {
}
}
-if (! md5sum
Cyril Brulebois wrote:
> IIRC MD5sum field was kept (as in: added
> back) because debian-cd needs it at the moment, which partly explains why this
> wasn't fixed earlier.
I think backward-compatibility would have been okay as long as *either*:
* the archive published Release files with old+new
Hi,
Steven Chamberlain (2017-02-27):
> Cyril Brulebois wrote:
> > AFAICT net-retriever does the fetching and checking work?
>
> Mayyybe...
>
> Although with
> http://ftp.de.debian.org/debian/dists/testing/main/installer-i386/20170127/images/netboot/mini.iso
> I observed md5sum and sha256sum on
Hello!
Cyril Brulebois wrote:
> AFAICT net-retriever does the fetching and checking work?
Mayyybe...
Although with
http://ftp.de.debian.org/debian/dists/testing/main/installer-i386/20170127/images/netboot/mini.iso
I observed md5sum and sha256sum only being executed as indicated in the
attached
Steven Chamberlain (2017-02-26):
> To date, anna still only implements MD5 verification of .udeb files,
> despite its formal deprecation as a digital signature algorithm by
> RFC6151 (2011) and recommendations of academic literature years prior.
>
> The files are typically downloaded via insecure
Source: anna
Version: 1.57
Severity: grave
Tags: security
X-Debbugs-Cc: secur...@debian.org
User: debian-rele...@lists.debian.org
Usertags: bsp-2017-02-de-Berlin
Control: block -1 by 856210
Hi,
To date, anna still only implements MD5 verification of .udeb files,
despite its formal deprecation as
9 matches
Mail list logo
