From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org [79.124.17.100]) by master.gitmailbox.com (Postfix) with ESMTP id E70294A5B9 for ; Sat, 30 Mar 2024 21:19:58 +0000 (UTC) Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id 6C58668C371; Sat, 30 Mar 2024 23:19:55 +0200 (EET) Received: from relay2-d.mail.gandi.net (relay2-d.mail.gandi.net [217.70.183.194]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id 385DB68C2B5 for ; Sat, 30 Mar 2024 23:19:48 +0200 (EET) Received: by mail.gandi.net (Postfix) with ESMTPSA id 325BE40002 for ; Sat, 30 Mar 2024 21:19:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=niedermayer.cc; s=gm1; t=1711833588; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=xquGydkwdACe1cSZLtX1EHCRYVVjrZalE3oU5xeaXBQ=; b=hewXKqhGssw6DGNl/ViQJhmT/MYhd33tfSwyB+mxtOepxVTgbDKFGMnKdsKHGmtIJuTJyj jABVQh2Lj58xFA2w9XdkUFnVHDU2rpr0SvkUMIu/F4n1ytWDsnI0eQnCWczb/bep0ohX40 agcWPJB+ZHo1Y6x2WIGTVMgQ6Fwl9oMOUiT9nAPOJl/6PFpbKdklgwcGyBNSrHuHMQl1N8 j3+fWlTYXbZj5UaOyq95U6meeW3hM2ttTAej/bqq/mNHe0cT2qiHE6wexni7UL1VlG8b8x ++ai+yVesTfUVH4lfQFU4AkHz8tQxa97feUtoOGV3bsh9GN12jxpBKm3Nr0gFg== Date: Sat, 30 Mar 2024 22:19:47 +0100 From: Michael Niedermayer To: FFmpeg development discussions and patches Message-ID: <20240330211947.GX6420@pb2> References: <20240330140225.3395-1-michael@niedermayer.cc> <20240330173039.GW6420@pb2> <7d01e878-f820-457c-9c65-53b985ba04a0@gmail.com> MIME-Version: 1.0 In-Reply-To: <7d01e878-f820-457c-9c65-53b985ba04a0@gmail.com> X-GND-Sasl: michael@niedermayer.cc Subject: Re: [FFmpeg-devel] [PATCH] web/download: Extend the verification procedure to check for difference between git and release tarball X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches Content-Type: multipart/mixed; boundary="===============8926453455929813930==" Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" Archived-At: List-Archive: List-Post: --===============8926453455929813930== Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="0RYZ5k6VxpttSKx1" Content-Disposition: inline --0RYZ5k6VxpttSKx1 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sat, Mar 30, 2024 at 02:31:54PM -0300, James Almer wrote: > On 3/30/2024 2:30 PM, Michael Niedermayer wrote: > > On Sat, Mar 30, 2024 at 11:51:17AM -0300, James Almer wrote: > > > On 3/30/2024 11:02 AM, Michael Niedermayer wrote: > > > > Iam not 100% sure this is the best place to put this. But we should= somewhere > > > > describe what differences are expected > > > >=20 > > > > Signed-off-by: Michael Niedermayer > > > > --- > > > > src/download | 34 ++++++++++++++++++++++++++++++++++ > > > > 1 file changed, 34 insertions(+) > > > >=20 > > > > diff --git a/src/download b/src/download > > > > index 0e6fa7e..34733de 100644 > > > > --- a/src/download > > > > +++ b/src/download > > > > @@ -284,6 +284,40 @@ gpg: using RSA key FCF986EA15E6= E293A5644F10B4322F04D67658D8 > > > > gpg: issuer "ffmpeg-devel@ffmpeg.org" > > > > gpg: Good signature from "FFmpeg release signing key <ffmpeg-= devel@ffmpeg.org>" [full] > > > > > > > > +
  • > > > > + Verify that the release tarball matches the git tag: (expe= cted differences are missing .git, .gitignore and .gitattributes and an add= itional VERSION file) > > > > + 
    > > > > +        $ diff -ru ffmpeg-5.1.4 gitdir2
> > > > +Only in gitdir2/doc/doxy: .gitignore
> > > > +Only in gitdir2/doc/examples: .gitignore
> > > > +Only in gitdir2/doc: .gitignore
> > > > +Only in gitdir2/ffbuild: .gitignore
> > > > +Only in gitdir2: .git
> > > > +Only in gitdir2: .gitattributes
> > > > +Only in gitdir2: .gitignore
> > > > +Only in gitdir2/libavcodec: .gitignore
> > > > +Only in gitdir2/libavcodec/tests: .gitignore
> > > > +Only in gitdir2/libavdevice: .gitignore
> > > > +Only in gitdir2/libavdevice/tests: .gitignore
> > > > +Only in gitdir2/libavfilter: .gitignore
> > > > +Only in gitdir2/libavfilter/opencl: .gitignore
> > > > +Only in gitdir2/libavfilter/tests: .gitignore
> > > > +Only in gitdir2/libavformat: .gitignore
> > > > +Only in gitdir2/libavformat/tests: .gitignore
> > > > +Only in gitdir2/libavutil: .gitignore
> > > > +Only in gitdir2/libavutil/tests: .gitignore
> > > > +Only in gitdir2/libswresample/tests: .gitignore
> > > > +Only in gitdir2/libswscale/tests: .gitignore
> > > > +Only in gitdir2/tests/api: .gitignore
> > > > +Only in gitdir2/tests/checkasm: .gitignore
> > > > +Only in gitdir2/tests: .gitignore
> > > > +Only in gitdir2/tools: .gitignore
> > > > +Only in ffmpeg-5.1.4: VERSION
> > > > +
    > > > > +
    • > > > > +
  • > > > > + Verify that the tag in git is signed > > >=20 > > > The tags are signed with your key made for this purpose, > > > DD1EC9E8DE085C629B3E1846B18E8928B3948D64, and not with the tarball one > > > listed above. You should include it here the same way, unless the sig= nature > >=20 > > yes but before doing that, do you think this is the best place to put a= ll this? >=20 > Sure, why would it not? It's the section where we explain how to verify > releases. The verification ends with the tarball signature being verified. Checking the difference between 2 mirrors, or git vs. tarball is not verifying if the user obtained a unmodified copy of a release. It would check for a subset of variants of compromises on the FFmpeg side. I think we should publish somewhere how the difference between git and tarball should look. But iam not sure anything is achieved by asking everyone to download things twice and compare them. Maybe the security page is a better place ? thx [...] --=20 Michael GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB Some people wanted to paint the bikeshed green, some blue and some pink. People argued and fought, when they finally agreed, only rust was left. --0RYZ5k6VxpttSKx1 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iF0EABEIAB0WIQSf8hKLFH72cwut8TNhHseHBAsPqwUCZgiB7AAKCRBhHseHBAsP q565AJ4sDP2ZXnjCabcC+Na0Ex1Sa01TngCfVkgq36hQJ6QuF1rxBaVOCLO/dG8= =JfWD -----END PGP SIGNATURE----- --0RYZ5k6VxpttSKx1-- --===============8926453455929813930== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ ffmpeg-devel mailing list ffmpeg-devel@ffmpeg.org https://ffmpeg.org/mailman/listinfo/ffmpeg-devel To unsubscribe, visit link above, or email ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe". --===============8926453455929813930==--