[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: What shall we do to verify the CVS diffs for emacs?

From: Kim F. Storm
Subject: Re: What shall we do to verify the CVS diffs for emacs?
Date: 17 Jan 2004 02:55:48 +0100
User-agent: Gnus/5.09 (Gnus v5.9.0) Emacs/21.3.50

Miles Bader <address@hidden> writes:

> On Fri, Jan 16, 2004 at 02:54:20PM -0500, Richard Stallman wrote:
> >     Then send me a list of the files you want to verify (C code or Lisp),
> >     or just request a list of files to check (and I'll chose some files
> >     for you).
> > 
> > My idea was that we would ask the various contributors to check the
> > changes they installed.  It doesn't have to be done that way; we
> > can try it this way too.
> I don't know whether it's useful, but I've been tracking the emacs CVS
> sources with my arch branch since before the break-in.
> Naturally, any bogus checkins to CVS would have been mirrored in the arch
> branch as well, but perhaps it might serve as check against retro-active
> modification of the CVS files on savannah.

Any checks you can make to improve confidence would be good, but if
bogus checkins are mirrored too, I don't really see how it can help us.

But a raw compare of the tip of CVS and arch would be inteseting.

> The intruder could have _also_ modified the arch archive to match[*] -- they
> are now gpg-signed, but unfortunately were not at the time of the incident --
> but that seems a fair bit less likely.  In addition, the archive has been
> mirrored on a non-GNU host since 1-sept (and arch mirrors are essentially
> append-only); however there's still a (small) avenue for compromise, even
> with the mirror, as I have an ssh key for it stored on fencepost.
> [*] stored on fencepost, in my home dir

I don't recall, so is the arch archive just a mirror of CVS, or
is it two ways (i.e. will changes to arch propagates back to CVS) ?

If the latter is the case, who has access to your arch archive,
and how do you control that access?

Kim F. Storm <address@hidden> http://www.cua.dk

reply via email to

[Prev in Thread] Current Thread [Next in Thread]