From mboxrd@z Thu Jan 1 00:00:00 1970 From: Peter =?utf-8?q?M=C3=BCller?= To: development@lists.ipfire.org Subject: State of affairs at lynis 3.0.6 (was: Re: lynis-3.0.6.tar.gz file on source.ipfire.org differs from Lynis upstream) Date: Sat, 23 Oct 2021 18:36:40 +0200 Message-ID: <91ce6ca7-7cc6-0b14-c25e-71b00643c7e3@ipfire.org> In-Reply-To: <7a208c9f-720b-3706-7c70-349c19111599@ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============3791443395366439125==" List-Id: --===============3791443395366439125== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hello *, trying to work through volume 5 of 100 of my TODO list, I stumbled across Lyn= is 3.0.6 once again. Since Packet Storm returned different source code files for every= download attempt, Arne reverted Adolf's patch in https://git.ipfire.org/?p=3Dipfire-2.= x.git;a=3Dcommit;h=3D55cb5e9324dbec88cac9581930aaee4e3a598a9b. Meanwhile, things have changed: Packet Storm now seems to return the same fil= e every time, no matter where the HTTPS request comes from. Checksums of the download= ed file also match the .tar.gz available at https://downloads.cisofy.com/lynis/lynis-= 3.0.6.tar.gz, while GitHub still offers a different version: > $ md5sum lynis-3.0.6.tar.gz-* > 23cc369984d564e4a8232473b1ace137 lynis-3.0.6.tar.gz-cisofy > c5429c532653a762a55a994d565372aa lynis-3.0.6.tar.gz-github > 23cc369984d564e4a8232473b1ace137 lynis-3.0.6.tar.gz-packetstorm Worse, CISOfy used do digitally sign releases, but https://downloads.cisofy.c= om/lynis/lynis-3.0.6.tar.gz.asc just shows a 404 to me - while PGP signatures for previous releases are prese= nt. This is bad, and does not look like they are taking security serious there. :-/ Therefore, I would vote for not updating to Lynis 3.0.6 at the moment. Versio= n 3.0.5 looks fine to me, at least it has a valid PGP signature. Let's hope the Lynis= folks get their stuff sorted soon - preferably before releasing version 3.0.7. Thanks, and best regards, Peter M=C3=BCller --===============3791443395366439125==--