<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'><pre>Hi all,
May I respectfully request the beginnings of a shift away from using MD5 hashes for upstream code? Collisions have been trivial to generate for a while now, so a man-in-the-middle attacker could easily substitute different source into the build process. This would completely circumvent the GPG signatures on the SBo tarballs.
You could argue that I shouldn't be relying on the MD5 hashes when I could check the code from the upstream, but I'm already verifying the SBo tarball, why not make it cover both? As I believe it was intended originally. You can also call me paranoid and you would be right ;)
A previous comment on the issue is here: <a rel="noreferrer" target="_blank" href="http://thread.gmane.org/gmane.linux.slackware.slackbuilds.user/10771">http://thread.gmane.org/gmane.linux.slackware.slackbuilds.user/10771</a>
Regards
Adrian<br><br></pre> </div></body>
</html>