Re: kernel.org status: hints on how to check your machine for intrusion

[Willy Tarreau]

On Sat, Oct 01, 2011 at 12:24:38PM -0700, Greg KH wrote:
> Very nice, thanks so much for providing an independant verification of
> the tarballs, it is much appreciated.
> 
> And yes, the umask problem did trip us up when we did the initial
> verification as well, fun to see that you all figured out and solved the
> problem faster than I did :)

I found that one of the remote machines I have access to has a fast
access to a mirror. So I'm currently collecting tar.gz sigs and tar
sigs. I stopped checking bz2 because that small machine takes 20s to
bzcat one file (for <1s file transfer)!

I discovered that 002/022 are not the only differences. Adrian used
to set 2.6.16.x at umask 000, and Linus changed the user in the
tarballs several times (torvalds, then git, then root). I'm also
seeing a certain greg/users for 2.6.11.x :-)

I think it will be easier to reproduce the sigs from the tags once
we have all the elements to know how the tar files were produced.

I'll post the tarball sigs here once I get them all. That way it
will already be possible to check if different ones are found on
some mirrors.

Willy

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/