Re: kernel.org status: hints on how to check your machine for intrusion

H. Peter Anvin
2011-10-02T00:11:21Z

On 10/01/2011 03:43 PM, Willy Tarreau wrote:
>
> <version> <umask> <user> <group> <tag md5> <tar md5> <tar.gz md5> <status>
>
> Since I can attest that I exclusively extracted the tarballs from the
> tar.gz and dumped their md5 at the same time, I'm pretty sure that the
> tar.gz's md5 is OK if the tar's md5 is OK. This will help speed up sig
> checks on mirrors.
>

By the way, it's usually better to use sha256 or something else more
modern than MD5.

> All the times I got a different MD5 between the tarball and the git
> tag was because of a different user name in the tarball. It seems
> that old git versions used to use "git/git" instead of "root/root"
> now.

Yes, that change was introduced in git-1.5.0-rc1.

> This is hardcoded so it's not easy to change it, and I suspect
> that the tar format might have changed a bit, so if we want to check
> those MD5s, either we check on old mirrors that are 100% safe, or we
> have to reinstall an old version of git.

... or extract the tarball and diff the contents versus the git tree.

-hpa