cvs commit: ports/sysutils/smartmontools distinfo

[Doug Barton]

On 10/23/2011 18:44, Eitan Adler wrote:
> 2011/10/23 Alexey Dokuchaev <danfe at freebsd.org>:
>> That's nice to know, but our bylaws require manual verification of the
>> contents of two distfiles when they change with no apparent reason (that is,
>> version stays the same) and presenting results in the commit log.
> 
> I checked the GPG signature of the file I downloaded. I was made aware
> that I should have included some indication of such in the commit log
> and will do so in the future.
> 
>> It (not doing so) had bitten us before, ARAIR.
> 
> As a security researcher who has found issues before in various open
> source projects, I fully understand the concern.

All that is great, but IMO still inadequate.

If the original 5.42 distfile is not available (and hopefully the
maintainer has it?), then comparing the new 5.42 to 5.41 would be a good
next step.


Doug

-- 

	Nothin' ever doesn't change, but nothin' changes much.
			-- OK Go

	Breadth of IT experience, and depth of knowledge in the DNS.
	Yours for the right price.  :)  http://SupersetSolutions.com/