[Slackbuilds-users] MD5 hashes for source code

[Adrian Blunck]

Hi all,

May I respectfully request the beginnings of a shift away from using MD5 hashes for upstream code? Collisions have been trivial to generate for a while now, so a man-in-the-middle attacker could easily substitute different source into the build process. This would completely circumvent the GPG signatures on the SBo tarballs.

You could argue that I shouldn't be relying on the MD5 hashes when I could check the code from the upstream, but I'm already verifying the SBo tarball, why not make it cover both? As I believe it was intended originally. You can also call me paranoid and you would be right ;)

A previous comment on the issue is here: http://thread.gmane.org/gmane.linux.slackware.slackbuilds.user/10771

Regards
Adrian

 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.slackbuilds.org/pipermail/slackbuilds-users/attachments/20160116/c5102629/attachment-0001.html>