Subject: Re: Heads up: suspicious source distribution of OpenSSH 3.4p1 found
To: Rogier Krieger <rogier@virgiel.nl>
From: Rick Byers <rb-netbsd@BigScaryChildren.net>
List: tech-security
Date: 08/02/2002 19:00:56
On Fri, 2 Aug 2002, Rogier Krieger wrote:

> >No -- the most common cause of checksum failures in pkgsrc is a file
> > remaining from a partial or interrupted download.  There would be
> >far  too many false positives.
>
> Given a regular modem connection, you're probably right on this. It
> will - though to a lesser degree - apply to systems on higher-grade
> connections. Still, I suspect a reporting capability can work if you
> only report a problem after retrying downloads that failed their
> checksum tests. Such would provide far more reliable data.
>
> Transfer errors will likely generate a timeout or error condition in
> the ftp or other fetching client. Retrying a download in such case
> seems a logical thing to do.

I've been annoyed in the past partial downloads are considered checksum
failures (I don't use a regular modem, but I do sometimes abort package
builds, which is often in the middle of downloading a file).

Wouldn't it make more sense to use a temporary filename while downloading
the file (possibly add some 'in progress' indicator to the distfile name),
and rename it once the download is complete?  This would make it easy to
detect parially downloaded files, and could allow for auto-resume of the
download (instead of the current, somewhat misleading checksum error).

This would have the nice side effect of making "send report message on
checksum failure" more feasable.  However, I don't know if thats a good
idea or not...

Rick