Re: [RFC] Enhance checksum support
On Sat, 19 Jan 2008, Frank Lichtenheld wrote:
> On Fri, Jan 18, 2008 at 11:38:55PM +1000, Anthony Towns wrote:
> > It'd actually be good to be able to break Files in future, so that we're
> > forced to verify something other than md5sum. Otherwise there will
> > be code that doesn't check it properly, and that will end up being a
> > security problem.
>
> Hmm, that might indeed be a good idea (the point to remove the Files
> field would be v3 then).
Note it also affects *.changes files.
> So maybe keep the Checksums field and introduce a Contents field that
> contains no checksums, but only the size and the name?
>
> Checksums:
> md5 4bf7ff17bd9ddf3846d9065b3c594fb4 foo
> sha256 28ee6a10eb280ede4b19c1b975aff5533016a26de67ba9212d51ffaea020ce34 foo
> Contents:
> 355 foo
> Files:
> 4bf7ff17bd9ddf3846d9065b3c594fb4 355 foo
>
> That makes the parsing more robust and eliminates the need to specifiy
> the size of a file more than once.
Looks good to me. It means we have quite some duplication until we can
drop Files but it's not a big deal IMO.
> If we want we could even declare size also to be a checksum and include
> only the filenames in the Contents field.
This makes sense from the logical point of view as the size is certainly
not useful except to verify that the files are the same... on the other
hand it would need some special casing as it wouldn't be calculated by an
external program. So a slight preference to keep it in Contents for me but
I would'nt mind if you decided the other way.
Cheers,
--
Raphaël Hertzog
Le best-seller français mis à jour pour Debian Etch :
http://www.ouaza.com/livre/admin-debian/
Reply to: