On Fri, 31 May 2013 21:46:23 -0500, Mike Schwab wrote: >On Fri, May 31, 2013 at 8:59 PM, Paul Gilmartin wrote: >>> >> ... One tool to verify identity is the checksum. ... >> >On the Mainframe, most programs have the date and time of the compile >stored in the eyecatcher near the name. Sometimes for a release they >change these to be the same. They often also add a PTF name into the >eyecatcher. > Can't all that be forged, perhaps by a programmer who feels the need to make a last-minute tweak and feels unfairly burdened by the process? Isn't that what "change these to be the same" amounts to? Perhaps harder with program objects, for which the data definition is secret.
I once had the requirement, with approval of Program management, to make such a change, not to executable code and with delivery deadline approaching. I built a second installation master tape, did mix-and-match with IEBGENER of data sets selected from the two masters, and verified checksums of all data sets except the one intentionally modified. But Program Management trusted my process and my checksums; I could have installed an Easter Egg. They should have had the verification performed by a relatively independent test organization. -- gil ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
