On Sun, 21 Oct 2012, Adam Osuchowski wrote: > Jan Rękorajski wrote: > > I'm afraid your patch doesn't work for me, I'm still getting bad md5 > > for config files: > > > > $ rpm -V wget > > ..5..... c /etc/wgetrc > > > > Am I missing something? > > Ok, I made investigation one more time and probably know what happened. > > The patch I sent is against build/files.c file which is part of rpmbuild > and fixes the problem by changing verify flags (placed in package file) > during package building. Only fresh built (by fixed rpmbuild) package > would be verified correctly even on buggy rpm. I forgot to tell about it > because I tested various scenarios and they all mixed up. > > So, once again: patch for build/files.c fixes package building process > only and would work if all packages in repo were been rebuilt (I don't > think RM will accede to this). > > In attachment, there is another patch, just for verification process. > It disables use of hmac during digest calculation entirely. Since in > rpm package files there are included plain md5sums, hmac support is > useless. I personally don't know what advantages does hmac digest have > over plain digest in case of files integrity verification against package > database (especially as the hmac key is constant and hardcoded in rpm > sources). > > So, to sum up: there are two ways to fix problem of reporting false > md5sum differences during packages verification: > * first, fix the building process and remain with hmac digests, but *ALL* > packages in repo should be rebuilt,
Rebuilding ~8500 packages is not an option, unfortunately :( > * second, fix the verification process only, drop hmac support and do it > the good old way. Quick question, does passing '--nohmacs' option give the same effect as your patch to lib/verify.c? In that case we could just make it default and add '--hmacs' option. -- Jan Rękorajski | PLD/Linux SysAdm | http://www.pld-linux.org/ baggins<at>mimuw.edu.pl baggins<at>pld-linux.org _______________________________________________ pld-devel-en mailing list [email protected] http://lists.pld-linux.org/mailman/listinfo/pld-devel-en
