Changeset 97ba425

Timestamp:

10/18/2021 10:47:42 AM (3 years ago)

Author:

Xi Ruoyao <xry111@…>

Branches:

11.1, 11.2, 11.3, 12.0, 12.1, 12.2, gimp3, kea, ken/TL2024, ken/inkscape-core-mods, ken/tuningfonts, lazarus, lxqt, plabs/newcss, plabs/python-mods, python3.11, qt5new, rahul/power-profiles-daemon, renodr/vulkan-addition, trunk, upgradedb, xry111/for-12.3, xry111/intltool, xry111/llvm18, xry111/soup3, xry111/spidermonkey128, xry111/test-20220226, xry111/xf86-video-removal

Children:

dcf242f

Parents:

2ef4e24b

Message:

building-notes: MD5 can be used to detect stealth update

File:

• introduction/important/building-notes.xml (modified) (1 diff)

introduction/important/building-notes.xml

@@ -113 +113 @@
 
     <para>MD5 is not cryptographically secure, so the md5sums are only
-    provided for detecting random errors or truncations introduced during
-    network transfer.  There is no <quote>100%</quote> secure way to make
+    provided for detecting unmalicious changes to the file content.  For
+    example, an error or truncation introduced during network transfer, or
+    a <quote>stealth</quote> update to the package from the upstream
+    (updating the content of a released tarball instead of making a new
+    release properly).</para>
+
+    <para>There is no <quote>100%</quote> secure way to make
     sure the genuity of the source files.  Assuming the upstream is managing
     their website correctly (the private key is not leaked and the domain is