From mboxrd@z Thu Jan 1 00:00:00 1970 From: Adolf Belka To: development@lists.ipfire.org Subject: Re: State of affairs at lynis 3.0.6 (was: Re: lynis-3.0.6.tar.gz file on source.ipfire.org differs from Lynis upstream) Date: Sat, 23 Oct 2021 19:06:35 +0200 Message-ID: <1a22ab81-2fce-4772-ec66-3f8edc6d5e19@ipfire.org> In-Reply-To: <91ce6ca7-7cc6-0b14-c25e-71b00643c7e3@ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============0341897404738386069==" List-Id: --===============0341897404738386069== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hi Peter, On 23/10/2021 18:36, Peter M=C3=BCller wrote: > Hello *, > > trying to work through volume 5 of 100 of my TODO list, I stumbled across L= ynis 3.0.6 > once again. Since Packet Storm returned different source code files for eve= ry download > attempt, Arne reverted Adolf's patch in https://git.ipfire.org/?p=3Dipfire-= 2.x.git;a=3Dcommit;h=3D55cb5e9324dbec88cac9581930aaee4e3a598a9b. > > Meanwhile, things have changed: Packet Storm now seems to return the same f= ile every > time, no matter where the HTTPS request comes from. Checksums of the downlo= aded file > also match the .tar.gz available at https://downloads.cisofy.com/lynis/lyni= s-3.0.6.tar.gz, > while GitHub still offers a different version: > >> $ md5sum lynis-3.0.6.tar.gz-* >> 23cc369984d564e4a8232473b1ace137 lynis-3.0.6.tar.gz-cisofy >> c5429c532653a762a55a994d565372aa lynis-3.0.6.tar.gz-github >> 23cc369984d564e4a8232473b1ace137 lynis-3.0.6.tar.gz-packetstorm > Worse, CISOfy used do digitally sign releases, but https://downloads.cisofy= .com/lynis/lynis-3.0.6.tar.gz.asc > just shows a 404 to me - while PGP signatures for previous releases are pre= sent. This > is bad, and does not look like they are taking security serious there. :-/ > > Therefore, I would vote for not updating to Lynis 3.0.6 at the moment. Vers= ion 3.0.5 > looks fine to me, at least it has a valid PGP signature. Let's hope the Lyn= is folks > get their stuff sorted soon - preferably before releasing version 3.0.7. I will then redo my lynis patch to update to 3.0.5 and supersede the previous= version. Adolf. > Thanks, and best regards, > Peter M=C3=BCller --===============0341897404738386069==--