[elbe-devel] elbe-testing doesn't work with local mirror

[Torben Hohn]

On Fri, Nov 16, 2018 at 03:52:05PM +0100, Manuel Traut wrote:
> Hi,
> 
> debmirror currently doesn't retrieve the SHA256 file for the debian installer.
> This is an (uncommented) issue since 03/2016 [0].
> 
> However elbes debinstaller.py only verifies the SHA256 file. We should consider
> to fix debmirror or at least use the MD5SUM file for now.

You mean falling back to MD5SUMS ?
MD5 is broken [0]. nowadays, its probably possible to compute collisions on
the fly.  

[0] https://www.bishopfox.com/resources/tools/other-free-tools/md4md5-collision-code/


> 
> As a workaround
> ---
> wget -O debian/dists/jessie/main/installer-amd64/current/images/SHA256SUMS \
> http://ftp.de.debian.org/debian/dists/jessie/main/installer-amd64/current/images/SHA256SUMS
> ---
> can be added to the end of a debmirror wrapper script.
> 
>   Manu
> 
> [0] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=819490
> 
> _______________________________________________
> elbe-devel mailing list
> elbe-devel at linutronix.de
> https://lists.linutronix.de/mailman/listinfo/elbe-devel

-- 
Torben Hohn
Linutronix GmbH | Bahnhofstrasse 3 | D-88690 Uhldingen-Mühlhofen
Phone: +49 7556 25 999 18; Fax.: +49 7556 25 999 99

Hinweise zum Datenschutz finden Sie hier (Informations on data privacy 
can be found here): https://linutronix.de/kontakt/Datenschutz.php

Linutronix GmbH | Firmensitz (Registered Office): Uhldingen-Mühlhofen | 
Registergericht (Registration Court): Amtsgericht Freiburg i.Br., HRB700 
806 | Geschäftsführer (Managing Directors): Heinz Egger, Thomas Gleixner
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: not available
URL: <http://lists.linutronix.de/pipermail/elbe-devel/attachments/20181121/014a9998/attachment.sig>