[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: RFS: chkrootkit 0.58b-2



Simon Josefsson <simon@josefsson.org> writes:

> Richard Lewis <richard.lewis.debian@googlemail.com> writes:
>
>> Hi,
>>
>> Would someone be able to sponsor an upload of chkrootkit?
>
> Done.

Thank-you!


Unfortunately, i messed up and made one part the tests too specific so
it fails on non-amd64. Can we try a 0.58b-3, based on the 3 new commits in
https://salsa.debian.org/pkg-security-team/chkrootkit/

Sorry for this - I believe it will work this time (if not i will work on
it on saturday), but I cant test on other architectures (i suppose i will
attempt to understand quemu again).

> I reviewed debian/* and it would be nice if more of the
> debian/patches/* had DEP3 headers and upstreamed as appropriate.

Agree

> It
> seems chkutmp.c and ifpromisc.c (including probably the patch
> debian/patches/87a_ifpromisc-Add-a-return-value.patch) are covered by
> GPLv3+ and not BSD-2-Clause, could you take a look and update
> debian/copyright for this?

Thanks - I have updated debian/copyright for this and some other things
i spotted.

(im not sure that that patch is really doing enough to count as
copyrightable, but makes sense to list it under the same license as the
.c).

> Upstream publish tarballs on insecure ftp:// URLs with no GPG
> signatures.  They do sign the *-m.zip with GPG.  Could you ask them to
> sign the release source code tarball with GPG too?  Or at least move the
> distribution to a https:// URL.

Thanks -- i will do this: The whole website was http until recently, and
they did change that, so hopefully this can be improved  (I dont think i
spotted the GPG before).

> I did verify the MD5sum (wtf?!)  against
> ftp://ftp.chkrootkit.org/pub/seg/pac/chkrootkit.md5 as being
> de110f07f37b1b5caff2e90cc6172dd8 so I'm hoping you worked on the same
> tarball.  Maybe we should check the tarball for rootkits :)

I confirm the same md5sum is what i used --- I have also read most of
the code (apart from ifpromisc.c, although i have looked at parts of
this), and checked the diff to the previous upstream version: no
rootkits, but some bugs and issues (not all solved)

Sorry again for the repeat


Reply to: