2 ms·
The article seems to mean "tarballs are obsolete for source distribution", not obsolete on the whole. > Here’s an advantage of the clone/pull distribution syst
by deathanatos 11y ago
The article seems to mean "tarballs are obsolete for source distribution", not obsolete on the whole.
> Here’s an advantage of the clone/pull distribution system; every clone is implicitly validated by its SHA1 hash chain.
Given that TLS does not consider SHA1 secure[1] anymore… I'm not sure that's an assumption I'd be making.
[1] in the sense that it's being rapidly deprecated; even if it doesn't trigger validation failures today, the fact that it will tomorrow is telling.
- eru 11y agoSHA1 is still good as a checksum against random errors.
- JoachimSchipper 11y agoSHA-1 is clearly imperfect, but not that big a problem here. The writing is on the wall for SHA-1's collision resistance. A break in collision resistance would allow a malicious software maintainer to distribute different tarballs to people of interest than to the internet at large, but would not allow a third party to replace a honestly-generated tarball with some other tarball ("second pre-image"). Since you almost certainly need to trust the maintainer not to insert backdoors anyway (a well-hidden backdoor will not be detected by the normal packaging process), trusting the maintainer not to maliciously distribute different software to a small number of people of interest isn't that unreasonable.