[elbe-devel] elbe-testing doesn't work with local mirror

[Manuel Traut]

On Wed, Nov 21, 2018 at 09:27:27AM +0100, Torben Hohn wrote:
> On Fri, Nov 16, 2018 at 03:52:05PM +0100, Manuel Traut wrote:
> > Hi,
> > 
> > debmirror currently doesn't retrieve the SHA256 file for the debian installer.
> > This is an (uncommented) issue since 03/2016 [0].
> > 
> > However elbes debinstaller.py only verifies the SHA256 file. We should consider
> > to fix debmirror or at least use the MD5SUM file for now.
> 
> You mean falling back to MD5SUMS ?
> MD5 is broken [0]. nowadays, its probably possible to compute collisions on
> the fly.  
> 
> [0] https://www.bishopfox.com/resources/tools/other-free-tools/md4md5-collision-code/

OK, can you please add a user visible message that points to the github issue if
we hit the situation? So a user is able to fixup its mirror.

For a long-term solution we should fix debmirror.

  Manu

> > 
> > As a workaround
> > ---
> > wget -O debian/dists/jessie/main/installer-amd64/current/images/SHA256SUMS \
> > http://ftp.de.debian.org/debian/dists/jessie/main/installer-amd64/current/images/SHA256SUMS
> > ---
> > can be added to the end of a debmirror wrapper script.
> > 
> >   Manu
> > 
> > [0] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=819490
> > 
> > _______________________________________________
> > elbe-devel mailing list
> > elbe-devel at linutronix.de
> > https://lists.linutronix.de/mailman/listinfo/elbe-devel
> 
> -- 
> Torben Hohn
> Linutronix GmbH | Bahnhofstrasse 3 | D-88690 Uhldingen-Mühlhofen
> Phone: +49 7556 25 999 18; Fax.: +49 7556 25 999 99
> 
> Hinweise zum Datenschutz finden Sie hier (Informations on data privacy 
> can be found here): https://linutronix.de/kontakt/Datenschutz.php
> 
> Linutronix GmbH | Firmensitz (Registered Office): Uhldingen-Mühlhofen | 
> Registergericht (Registration Court): Amtsgericht Freiburg i.Br., HRB700 
> 806 | Geschäftsführer (Managing Directors): Heinz Egger, Thomas Gleixner