litan on IRC mentioned the deblob scripts in our releases/ tree were not signed, making it risky to download and run them, since they might have been corrupted (intentionally or not) in the server or in transit.
I've just verified all of the deblob-* scripts in there to make sure that they matched the corresponding file in our svn repository. There were about 10 files that did not match: nearly all of them were deblob-check scripts modified within a stable cycle, with cherry-picked patches that I manually verified against the corresponding patch in the svn tree. Two others were deblob-<kver> from -rc releases, that were different from the svn file of the same vintage in that the svn file had extra=0--, to indicate a pre-release, whereas the script used to clean up the -rc release did not. When that script was used in the final release, it was checked into svn, but in case the script underwent changes, no exact match would be found in the repository. So, I had to check those by hand. The only other exception was 2.6.28.10-gnu1/deblob-2.6.28, that started with 's#!/bin/sh'. Presumably some failed C-x C-s that somehow failed to fail right away. I seem to have noticed the error a couple of days later, because 2.6.28-gnu1/deblob-2.6.28 was fixed then, but the other file remained broken. I have replaced the broken file with a hard link to the then-fixed script. I also checked the per-release links to the COPYING file in that tree, as well as a few README* files in there, to make sure they had not been corrupted. Once I was happy with all the checking, I signed all of the files, and then verified that they still matched the hashes I had computed before starting it all. So, from now on, all files within releases/ will be signed. Now, I'm working on creating tags/ dirs for each release that had changes to the deblobbing scripts, and branches/ dirs with the change history of each tree. -- Alexandre Oliva, freedom fighter http://FSFLA.org/~lxoliva/ You must be the change you wish to see in the world. -- Gandhi Be Free! -- http://FSFLA.org/ FSF Latin America board member Free Software Evangelist|Red Hat Brasil GNU Toolchain Engineer _______________________________________________ linux-libre mailing list [email protected] http://www.fsfla.org/cgi-bin/mailman/listinfo/linux-libre
