Bug#572571: packages SHOULD ship checksums (a-la dh_md5sums, but better)

[Goswin von Brederlow <goswin-v-b@web.de>]

Russ Allbery <rra@debian.org> writes:

> Bill Allombert <Bill.Allombert@math.u-bordeaux1.fr> writes:
>> On Thu, Mar 04, 2010 at 11:00:45PM +0100, Stefano Zacchiroli wrote:
>
>>> Currently, packages ships file checksums which are computed at package
>>> build time by the means of dh_md5sums (usually), and stored under
>>> /var/lib/dpkg/info/*md5sums.  Several people find those checksums
>>> useful, mostly for file corruption detection a-la CRC.
>
>>> Empirical tests show that the archive coverage is pretty good, most
>>> packages seem to ship those checksums.
>
>>> Hence, there is a desire to turn a similar feature into, for start, a
>>> SHOULD requirement, meant to become a MUST later on.
>
>> If we are moving that way, maybe it would make sense for the checksums
>> to be generated by dpkg-buildpackage.
>
> One does have to be able to exclude some things on a per-package basis
> since there are some weird cases in the archives.  (Files in
> /var/lib/[ai]spell are the one case that Lintian knows about at present.)

Why?

A use case for the md5sum file is to show all files that are modified in
respect to what the deb contains. The files are modified and should show
up as not matching the md5sum. I think it is a bug of [ai]spell to ship
the files if they modify them.

MfG
        Goswin