Re: CVS commit: pkgsrc/archivers/szip

[Alan Barrett <apb%cequrux.com@localhost>]

On Sun, 20 Nov 2011, John Marino wrote:
> Yes, I guess it's possible that somebody hacked into the 
> hdfgroup.org server, and replaced the source tarball with one 
> with a trojan in it after hdfgroup repacked the same tarball 3 
> times before.  But no, I did not do a line-by-line diff on all 
> the sources because primarily I didn't have the original source. 
> It was no longer available (the entire reason it caught my 
> attention.)

When you encounter a package whose distfile name stays the same 
while the distfile contents change, you should immediately be 
very suspicious.  If you can't compare the old and new distfiles 
because you don't have the old distfile, then you could ask 
whether anybody else has the old distfile.

If a particular upstream maintainer has a history of making such 
changes, then I think we should try extra hard to keep a stable 
version of the distfile on a netbsd server.

--apb (Alan Barrett)