X-Original-To: alpine-devel@lists.alpinelinux.org
Received: from mail-pg0-f48.google.com (mail-pg0-f48.google.com [74.125.83.48])
	by lists.alpinelinux.org (Postfix) with ESMTP id 7126A5C44CA
	for <alpine-devel@lists.alpinelinux.org>; Tue, 15 Aug 2017 03:03:21 +0000 (GMT)
Received: by mail-pg0-f48.google.com with SMTP id v189so59034611pgd.2
        for <alpine-devel@lists.alpinelinux.org>; Mon, 14 Aug 2017 20:03:21 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20161025;
        h=x-gm-message-state:mime-version:references:in-reply-to:from:date
         :message-id:subject:to;
        bh=RO2PS5vbBMuzG48YmOVAC/MH9QqYe5myFpWjZ9ZETaw=;
        b=uev2HV/YdC81bpQIXJqogkDxqrVD9IGFEjWmmaqzLFFS3SLhr9D+O5K8vGkYlKa8Vx
         ZfVrZm2nF9Y8C1B0i8d8lcq9QPJz/JpPJaGSSYkCLddGtx2vafASmqFcYFMT3m5VeOcy
         Wme94lKL5zSxCP93IrfP5Wlp1LLtmrXQ4vYWOcPzeHkUSeJK1VyDVds8hPa9b/cX+nti
         Nid7o2OzyFzBTUIz0pe82rh7nu0oQpaPe6xZ6VDEsQMKdY9kBlQAx0dQuVr4hkhAsWy/
         u6Vh1ScH71pB6xEBslk15p8mFSyrWxP49YGuTjHOk9lDfodskfCd361D3VTcqD1vFpPD
         LSfA==
X-Gm-Message-State: AHYfb5gAu83hym9bbCr/t7nm6MDBCouQHFvliKd9OK6V2MgQlgLRT/IO
	DnFC0eVtLYClnLfn+owMwEdbQ+oYcQ==
X-Received: by 10.84.160.226 with SMTP id v31mr29090470plg.91.1502766200781;
 Mon, 14 Aug 2017 20:03:20 -0700 (PDT)
X-Mailinglist: alpine-devel
Precedence: list
List-Id: Alpine Development <alpine-devel.lists.alpinelinux.org>
List-Unsubscribe: 
	<mailto:alpine-devel+unsubscribe@lists.alpinelinux.org?subject=unsubscribe>
List-Post: <mailto:alpine-devel@lists.alpinelinux.org>
List-Help: <mailto:alpine-devel+help@lists.alpinelinux.org?subject=help>
List-Subscribe: 
	<mailto:alpine-devel+subscribe@lists.alpinelinux.org?subject=subscribe>
MIME-Version: 1.0
References: <trinity-c8ba54cb-8af1-40ca-baa1-1b87232dcbcf-1502765946385@3c-app-mailcom-lxa14>
In-Reply-To: <trinity-c8ba54cb-8af1-40ca-baa1-1b87232dcbcf-1502765946385@3c-app-mailcom-lxa14>
From: Kiyoshi Aman <aphrael@alpinelinux.org>
Date: Tue, 15 Aug 2017 03:03:10 +0000
Message-ID: <CAML-UdtpXfCj-zoPbBW+_fCCB_iJ_qKbY4PPf1HT+8rOmO3cmg@mail.gmail.com>
Subject: Re: [alpine-devel] ABUILD checksums verification
To: Tmp File <tmpfile@mail.com>, alpine-dev <alpine-devel@lists.alpinelinux.org>
Content-Type: multipart/alternative; boundary="94eb2c14847e9403700556c2052b"

--94eb2c14847e9403700556c2052b
Content-Type: text/plain; charset="UTF-8"

Hi,

This is not a problem as the file includes an md5sum, which is still
checked.

On Mon, Aug 14, 2017 at 9:59 PM Tmp File <tmpfile@mail.com> wrote:

> Hello Alpinists.
>
> I thought abuild refused to build packages in case the sha512sum was
> absent or wrong.
> So when I noticed a commit that pushed a package with no sha512sum I
> expected it to fail.
>
> https://github.com/alpinelinux/aports/commit/ea042a80dc99d3399dccbd8782041fda178aeab0
> But to my surprise the package was built!
> It can now be found on the official repository.
> If the sha512sum is being ignored and any package is being built and
> distributed... this sounds like security issue.
>
> If I made any mistake please clear up.
> But as I understand right now py-redis was built and distributed without
> verification of sha512sum.
>
> tmpfile.
>
>
> ---
> Unsubscribe:  alpine-devel+unsubscribe@lists.alpinelinux.org
> Help:         alpine-devel+help@lists.alpinelinux.org
> ---
>
> --
-- Kiyoshi Aman

--94eb2c14847e9403700556c2052b
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi,<div><br></div><div>This is not a problem as the file i=
ncludes an md5sum, which is still checked.</div></div><br><div class=3D"gma=
il_quote"><div dir=3D"ltr">On Mon, Aug 14, 2017 at 9:59 PM Tmp File &lt;<a =
href=3D"mailto:tmpfile@mail.com">tmpfile@mail.com</a>&gt; wrote:<br></div><=
blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px=
 #ccc solid;padding-left:1ex">Hello Alpinists.<br>
<br>
I thought abuild refused to build packages in case the sha512sum was absent=
 or wrong.<br>
So when I noticed a commit that pushed a package with no sha512sum I expect=
ed it to fail.<br>
<a href=3D"https://github.com/alpinelinux/aports/commit/ea042a80dc99d3399dc=
cbd8782041fda178aeab0" rel=3D"noreferrer" target=3D"_blank">https://github.=
com/alpinelinux/aports/commit/ea042a80dc99d3399dccbd8782041fda178aeab0</a><=
br>
But to my surprise the package was built!<br>
It can now be found on the official repository.<br>
If the sha512sum is being ignored and any package is being built and distri=
buted... this sounds like security issue.<br>
<br>
If I made any mistake please clear up.<br>
But as I understand right now py-redis was built and distributed without ve=
rification of sha512sum.<br>
<br>
tmpfile.<br>
<br>
<br>
---<br>
Unsubscribe:=C2=A0 <a href=3D"mailto:alpine-devel%2Bunsubscribe@lists.alpin=
elinux.org" target=3D"_blank">alpine-devel+unsubscribe@lists.alpinelinux.or=
g</a><br>
Help:=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<a href=3D"mailto:alpine-devel%2Bhel=
p@lists.alpinelinux.org" target=3D"_blank">alpine-devel+help@lists.alpineli=
nux.org</a><br>
---<br>
<br>
</blockquote></div><div dir=3D"ltr">-- <br></div><div class=3D"gmail_signat=
ure" data-smartmail=3D"gmail_signature"><div dir=3D"ltr">-- Kiyoshi Aman</d=
iv></div>

--94eb2c14847e9403700556c2052b--


---
Unsubscribe:  alpine-devel+unsubscribe@lists.alpinelinux.org
Help:         alpine-devel+help@lists.alpinelinux.org
---