Am Di., 22. Sept. 2026 um 08:51 Uhr schrieb Zbigniew Jędrzejewski-Szmek <[email protected]>: > I think we should do this. If we accept the premise that the old > hash cannot be trusted (i.e. that it's possible to craft a collision), > then we want _all_ packages to use the new hash. If at least one > package uses the "weak" hash, it becomes a potential attack vector. > > I think it'd make sense to apply this through a provenpackager. > For each of the packages, fetch the sources from the cache, recompute > the checksum, save new sources file. The commit should be done with > '[skip changelog]' for packages with %autochangelog, and with no > changelog entry for the rest.
As you wrote, the old hash cannot be trusted; we cannot be sure that the tarball downloaded during this process is still the 'correct' one. Therefore, a simple download-rehash-upload cycle would only protect against future attacks, not ones that have already occurred. Indeed, it would merely mask the issue. - Thomas -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
