From owner-freebsd-ports-bugs@FreeBSD.ORG Sun Apr 20 12:10:01 2014 Return-Path: Delivered-To: freebsd-ports-bugs@smarthost.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id C3720BB5 for ; Sun, 20 Apr 2014 12:10:01 +0000 (UTC) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:1900:2254:206c::16:87]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id B0CC5188E for ; Sun, 20 Apr 2014 12:10:01 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.8/8.14.8) with ESMTP id s3KCA1aE017362 for ; Sun, 20 Apr 2014 12:10:01 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.8/8.14.8/Submit) id s3KCA1gh017361; Sun, 20 Apr 2014 12:10:01 GMT (envelope-from gnats) Date: Sun, 20 Apr 2014 12:10:01 GMT Message-Id: <201404201210.s3KCA1gh017361@freefall.freebsd.org> To: freebsd-ports-bugs@FreeBSD.org Cc: From: John Marino Subject: Re: ports/188815: devel/libserver: BROKEN due to failed checksum X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list Reply-To: John Marino List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 20 Apr 2014 12:10:01 -0000 The following reply was made to PR ports/188815; it has been noted by GNATS. From: John Marino To: James Bailie , bug-followup@FreeBSD.org Cc: Subject: Re: ports/188815: devel/libserver: BROKEN due to failed checksum Date: Sun, 20 Apr 2014 14:03:29 +0200 On 4/20/2014 13:47, James Bailie wrote: > Make makesum. Tarball is correct. > This hash should be provided to the PR first. Imagine that the tarball got switched maliciously before a committer got a chance to "make makesum" and they accidentally blessed an intentionally compromised tarball. This is why digests exist in the first place -- to be 100% sure that downloaded file is what was intended. John