tech-pkg archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]


On Fri, 2013-06-07 at 16:16 +0200, Marc Espie wrote:
> On Fri, Jun 07, 2013 at 11:54:53PM +1200, David Sainty wrote:
> > The situation for fetching is Very Very different to building phases,
> > because there's already a repeatability firewall, in the form of
> > distinfo digests, that makes it impossible for misbehaviour in the fetch
> > phase to go unnoticed - and so the environment will never have any
> > bearing on the final contents of the package.
> Difficult, not impossible. Especially for a motivated attacker.
> Both md5 and sha1 have  known birthday attacks.
> gzip, bzip2, tar, ignore garbage at end of archives...

That's a good reason to continually ensure Pkgsrc's selection of digest
algorithms is robust.

But I don't think that's the kind of problem we need to worry about as
far as environment sanitisation goes.  I.e. that concern applies even if
the environment is sanitised.

Home | Main Index | Thread Index | Old Index