cvs commit: ports/chinese/ibus-chewing distinfo
danfe at FreeBSD.org
Tue Dec 14 03:08:09 UTC 2010
On Mon, Dec 13, 2010 at 01:34:53PM -0500, Wesley Shields wrote:
> On Mon, Dec 13, 2010 at 06:19:10PM +0000, Philip M. Gollucci wrote:
> > On 12/13/10 16:41, Wesley Shields wrote:
> > > On Mon, Dec 13, 2010 at 04:37:17AM +0000, Philip M. Gollucci wrote:
> > >> pgollucci 2010-12-13 04:37:17 UTC
> > >>
> > >> Modified files:
> > >> chinese/ibus-chewing distinfo
> > >> Log:
> > >> - Fix checksum
> > >
> > > I thought it was a good idea to state what changed when a distfile was
> > > re-rolled without a version bump.
> > Well it is, but they re-rolled inbetween my tb test, commit and QAT
> > processing it. I can go digg it up but I was just trying to fix the QAT
> > nag mail at the time.
> I'm not requesting that you do that, but it could potentially be a
> malicious distfile now. We need to be extra careful not to propagate
> those if we can help it, hence the suggestion to document what was
> changed in order to show due diligence.
> I realize the chances of this one being malicious is small, but it is
> best to diff the two before commit, even if QAT is angry at you.
It does not matter how low are chances. It is clearly *required* (both
by common sense and our policy) to manually review any differences in
distfiles when checksum silently changes without obvious reason.
Confirming with upstream developer/maintainer is also good thing to do.
I am surprised we even need to discuss these things.
More information about the cvs-ports