[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#622941: marked as done (Please provide SHA256SUMS for debian-installer images)

Your message dated Fri, 02 Dec 2011 18:48:12 +0100
with message-id <8762hyeug3.fsf@lennier.ganneff.de>
and subject line Done
has caused the Debian Bug report #622941,
regarding Please provide SHA256SUMS for debian-installer images
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
622941: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=622941
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message --- 
Package: ftp.debian.org

Hi,
I was really happy to see that the signed Release file now includes MD5, SHA1, and SHA256 hashes for main/installer-*/current/images/MD5SUMS, which allows authenticating the debian-installer images (this was bug #611087). However, as mentioned in the bug, having just MD5SUMS is weak. MD5 only was a bad idea in 2004, and it's really not okay today -- for instance, the textbook I use in my computer and network security class has "Generate an MD5 collision" as one of the end-of-chapter problems [1].
Can you provide SHA256SUMS for the installer images in addition to MD5SUMS, and include them in the Release file too? 

Thanks,
--
Geoffrey Thomas
geofft@mit.edu

[1] http://www.schneier.com/book-ce-links.html

--- End Message ---
--- Begin Message --- 
Ha,

fast Joey:

18:35:01 <CIA-2> joey * reddec2e debian-installer/ (build/Makefile debian/changelog): Add SHA256SUMS file like MD5SUMS file. 
                 (See #622941)

That is, next uploads include them.
I see about doing some for touchable suites manually so we have some.

-- 
bye, Joerg
<exa> look i can't afford to to any more work without becoming a DD

--- End Message ---
Reply to: