Re: kernel.bkbits.net off the air

[Larry McVoy <lm@bitmover.com>]

On Thu, Nov 13, 2003 at 04:23:24PM +0100, Andreas Schwab wrote:
> Andrea Arcangeli <andrea@suse.de> writes:
> 
> > On Wed, Nov 12, 2003 at 10:35:22PM +0100, Benoit Poulot-Cazajous wrote:
> >> Andrea Arcangeli <andrea@suse.de> writes:
> >> 
> >> > the usual problem, and the reason we need a sequence number (increased
> >> > before and after the repo update). A file lock not.
> >> 
> >> Or a file that contains md5sums of the other files in the tree. 
> >> After the rsync, you recompute the md5sums file, and if it does not match,
> >> rsync again. As a bonus feature, the md5sums file can be pgp-signed.
> >
> > agreed, this would work too and it has the advantage of working with the
> > mirrors too as far as the per-file updates are atomic (should always be
> > the case). This has the only disavanage of forcing the client and the
> > server to read all file contents (I normally don't rsync with -c).
> 
> This is not necessary, you only need to recompute the md5sums of changed
> files.

If we had this approach we wouldn't have caught the torjan horse in the
CVS tree.  We checksum all the data, changed or not.  Your approach
pushes that duty onto the end users, and let's have a show of hands,
how many of you md5sum every bit of data that you download from the net?
(Please don't reply to that, it's a rhetorical question and I think the
vast majority of the people already know the answer.)
-- 
---
Larry McVoy              lm at bitmover.com          http://www.bitmover.com/lm