newsNews: Changesets for auditing software post-crack are available

 
 
Latest News
Savannah https SSL Certificates Updated posted by rwp, Thu 06 Mar 2014 09:11:43 AM UTC - 0 replies
Bazaar upgraded posted by mjflick, Tue 22 May 2012 02:49:11 AM UTC - 0 replies
git / cgit updated posted by mjflick, Fri 09 Dec 2011 12:13:52 AM UTC - 0 replies
New Project Submissions Re-enabled posted by mjflick, Tue 22 Nov 2011 09:52:31 PM UTC - 0 replies
new project submissions disabled posted by karl, Thu 10 Nov 2011 12:27:27 AM UTC - 0 replies
[172 news in archive]

Changesets for auditing software post-crack are available

Item posted by Bradley M. Kuhn <bkuhn> on Tue 23 Dec 2003 12:49:18 AM UTC.

A GPG-signed text file of this message is available at:
http://savannah.gnu.org/statements/changesets-available.txt.asc

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Sunday 14 December 2003, 06:18 EST

Regular Savannah services, including cvs commit access and Savannah's web
interface, remain down. We continue to investigate a number of software
vulnerabilities that we believe may have contributed to the crack on
Savannah. We must be certain that any security problems are addressed
before we put the software back up for public use. We will also publish
our findings to assist other Free Software sites and to encourage general
improvement of commonly used Free Software infrastructure.

At this time, I am pleased to announce that the results of the automated
comparison between the last trusted CVS trees and the current trees are
available. You can download yours at:

ftp://ftp.gnu.org/savannah/changsets/FOO-changes.tar.gz

where "FOO" refers to the name of your package. GPG signed md5sums of all
the FOO-changes.tar.gz files can be found at
<URL:ftp://ftp.gnu.org/savannah/changesets/md5sums.asc>.

Each package with changes made after the trusted backup has a
corresponding file on ftp.gnu.org. If a package contains no changes, or
subversions/savannah is not the canonical location of a package's CVS
tree, then the tar file described above will not exist for that package.

Each tar file contains a set of diff files. Each diff file corresponds to
one CVS branch. The diffs start from the latest version in a branch and
extend back to the last version of the file verified against a backup.

These difference sets should assist you in auditing your software. Once
you have audited your packages, please contact
<savannah-compromise@gnu.org>, and let us know the results.

Some savannah users have noticed some inconsistencies in our backup. In
some instances, while the tree itself is dated 16 September 2003, some
files might be older because they were not properly copied due to an rsync
bug. We believe that these problems were introduced by the deflate rsync
bug (documented at
<URL:http://lists.samba.org/archive/rsync/2003-July/006518.html>). So, we
suggest you focus on the versions themselves, rather than by-date
comparisons. The difference sets should help in that work.

Finally, we have confirmed that the current tree, when its subversions
are compared to the equivalent subversions in the "16 September" tree,
match completely, or have trivial differences that can be explained.

We continue working as quickly as we can to bring the services back
online. We will post another update on the evening (EST) of Wednesday 17
December 2003.

Sincerely,

Bradley M. Kuhn
Executive Director, Free Software Foundation
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE/3Ece53XjJNtBs4cRAqAtAJ9bAhrFh18lDbuuOiCxfZb/kouskACcCe8E
BDPWQFrZ629Pd3b3SOHe150=
=4O2D
-----END PGP SIGNATURE-----

Comments:

No messages in Changesets for auditing software post-crack are available

 

Back to the top


Powered by Savane 3.1-cleanup