On Fri, Jul 24, 2026 at 03:23:26AM +0200, Benjamin Drung wrote: > On Fri, 17 Jul 2026 18:07:40 +0200 Santiago Vila <[email protected]> > wrote: > > Patch 3 is incomplete and therefore wrong: Using sha256sum alone will > > not work unless there is a matching file with the sha256sums of old > > files, which your patch misses completely. To do it "right", one would > > have to recalculate those hashes on the old files using the new > > function, but given that there is no real security gain in doing so, > > I'm not going to change it at this point. (People do not replace their > > working /etc/profile file by another file having the same md5sum as an > > old version just for fun). > > I wrote a script to calculate the hash for the historic versions to add > the version information to the Ubuntu file. I could easily rework that > to produce the corresponding sha256sums. Are you open to such a patch?
No. The reason is just above what you wrote. This is not security relevant. Thanks.
