netstat-nat: add hash file
PATCH 1/4 netstat-nat: add hash file
--- package/netstat-nat/netstat-nat.hash | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 package/netstat-nat/netstat-nat.hash
package/netstat-nat/netstat-nat.hash new file +2 -0
@@ -0,0 +1,2 @@ +# Locally calculated +sha256 e945faa283a49f33af15de915a949c9273a230fc17154925364c547adab676ca netstat-nat-1.4.10.tar.gz
Signature · 1 line
2.3.6
PATCH 2/4 rp-pppoe: add hash file
--- package/rp-pppoe/rp-pppoe.hash | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 package/rp-pppoe/rp-pppoe.hash
package/rp-pppoe/rp-pppoe.hash new file +2 -0
@@ -0,0 +1,2 @@ +# Locally calculated after checking pgp signature +sha256 86a1a4d92fcea74fa6dd45516c5975933fa978b36fafe71f76ea70b4b4747720 rp-pppoe-3.11.tar.gz
Signature · 1 line
2.3.6
PATCH 3/4 transmission: add hash file
In reply to Gustavo Zacarias--- package/transmission/transmission.hash | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 package/transmission/transmission.hash
package/transmission/transmission.hash new file +2 -0
@@ -0,0 +1,2 @@ +# Locally calculated +sha256 a9fc1936b4ee414acc732ada04e84339d6755cd0d097bcbd11ba2cfc540db9eb transmission-2.84.tar.xz
Signature · 1 line
2.3.6
PATCH 4/4 popt: add hash file
In reply to Gustavo Zacarias--- package/popt/popt.hash | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 package/popt/popt.hash
package/popt/popt.hash new file +2 -0
@@ -0,0 +1,2 @@ +# Locally calculated based on http://anduin.linuxfromscratch.org/sources/BLFS/svn/p/popt-1.16.tar.gz.md5sum +sha256 e728ed296fe9f069a0e005003c3d6b2dde3d9cad453422a10d6558616d304cc8 popt-1.16.tar.gz
Signature · 1 line
2.3.6
PATCH 4/4 popt: add hash file
Hi Gustavo,
package/popt/popt.hash line 1
Quoted 13 lines · Gustavo Zacarias
Signed-off-by Gustavo Zacarias <[email protected]>--- package/popt/popt.hash | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 package/popt/popt.hashpackage/popt/popt.hash new file +1
-0@@ -0,0 +1,2 @@ +# Locally calculated based on http://anduin.linuxfromscratch.org/sources/BLFS/svn/p/popt-1.16.tar.gz.md5sum
What does that mean?
package/popt/popt.hash line 2
Quoted 1 line
package/popt/popt.hash new file +1
-0+sha256 e728ed296fe9f069a0e005003c3d6b2dde3d9cad453422a10d6558616d304cc8 popt-1.16.tar.gz
baruch
Signature · 3 lines
http://baruch.siach.name/blog/ ~. .~ Tk Open Systems
=}------------------------------------------------ooO--U--Ooo------------{=
- baruch at tkos.co.il - tel: +972.2.679.5364, http://www.tkos.co.il -PATCH 4/4 popt: add hash file
Quoted 5 lines · Baruch Siach
Quoted 1 line
+# Locally calculated based on http://anduin.linuxfromscratch.org/sources/BLFS/svn/p/popt-1.16.tar.gz.md5sum
What does that mean?
Quoted 1 line
+sha256
e728ed296fe9f069a0e005003c3d6b2dde3d9cad453422a10d6558616d304cc8popt-1.16.tar.gz
Hi Baruch.
That i've verified that the md5 is right and then calculated the sha256. Regards.
PATCH 4/4 popt: add hash file
Quoted 9 lines · Gustavo Zacarias
Quoted 5 lines · Baruch Siach
Quoted 1 line
+# Locally calculated based on http://anduin.linuxfromscratch.org/sources/BLFS/svn/p/popt-1.16.tar.gz.md5sum
What does that mean?
Quoted 1 line
+sha256
e728ed296fe9f069a0e005003c3d6b2dde3d9cad453422a10d6558616d304cc8popt-1.16.tar.gzThat i've verified that the md5 is right and then calculated the sha256.
Is there a reason not to have both md5 (from LFS) and sha256 (locally calculated)?
baruch
Signature · 3 lines
http://baruch.siach.name/blog/ ~. .~ Tk Open Systems
=}------------------------------------------------ooO--U--Ooo------------{=
- baruch at tkos.co.il - tel: +972.2.679.5364, http://www.tkos.co.il -PATCH 4/4 popt: add hash file
Quoted 2 lines · Baruch Siach
Is there a reason not to have both md5 (from LFS) and sha256 (locally calculated)?
Yes, very subjective though.
Right now we're fetching from a mirror and that's where the md5 comes from. Proper upstream is back but never provided a md5 or sig for the latest releases, so that md5 isn't "original".
I based my calculation on a locally cached popt tarball that predates the source change BTW.
And to be honest hashes that aren't backed by announcements (archived on mailing lists that are on separate infra, hence harder to tamper with) are worth almost nothing.
Regards.
PATCH 4/4 popt: add hash file
Dear Gustavo Zacarias,
Quoted 9 lines · Gustavo Zacarias
Yes, very subjective though.
Right now we're fetching from a mirror and that's where the md5 comes from. Proper upstream is back but never provided a md5 or sig for the latest releases, so that md5 isn't "original".
I based my calculation on a locally cached popt tarball that predates the source change BTW.
And to be honest hashes that aren't backed by announcements (archived on mailing lists that are on separate infra, hence harder to tamper with) are worth almost nothing.
Though our policy so far is to have the upstream hash when available, and if it's too weak complement it with a locally calculated stronger hash.
Thanks,
Thomas
Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons Embedded Linux, Kernel and Android engineering http://free-electrons.com
PATCH 4/4 popt: add hash file
Quoted 3 lines · Thomas Petazzoni
Though our policy so far is to have the upstream hash when available, and if it's too weak complement it with a locally calculated stronger hash.
Yes, but this is a mirror hash, not an upstream one.
There are no hashes @ http://rpm5.org/files/popt/
Hence it's a "locally calculated" plus "i've also checked the mirror md5". Regards.
PATCH 1/4 netstat-nat: add hash file
In reply to Gustavo ZacariasDear Gustavo Zacarias,
Quoted 5 lines · Gustavo Zacarias
Signed-off-by Gustavo Zacarias <[email protected]>--- package/netstat-nat/netstat-nat.hash | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 package/netstat-nat/netstat-nat.hash
All four patches applied, thanks.
Thomas
Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons Embedded Linux, Kernel and Android engineering http://free-electrons.com