[Bug debuginfod/30978] debuginfod-client security: optionally(?) verify downloaded binaries

2023-10-18 Thread rfhn.fhbrrjnzeneqpf at noclue dot notk.org
https://sourceware.org/bugzilla/show_bug.cgi?id=30978 --- Comment #5 from Dominique Martinet --- debian has kept .gnu_debuglink (like fedora), so if we extend that to store a more reliable hash I believe that process should be fairly straightforward as they already must have an objcopy --add-gnu-

[Bug debuginfod/30978] debuginfod-client security: optionally(?) verify downloaded binaries

2023-10-17 Thread rfhn.fhbrrjnzeneqpf at noclue dot notk.org
https://sourceware.org/bugzilla/show_bug.cgi?id=30978 --- Comment #3 from Dominique Martinet --- Interesting, thanks for the link! The implementation hurdle is a bit higher than updating the already-used objcopy command I was suggesting (won't be available for distros like debian that don't ship

[Bug debuginfod/30978] debuginfod-client security: optionally(?) verify downloaded binaries

2023-10-17 Thread rfhn.fhbrrjnzeneqpf at noclue dot notk.org
https://sourceware.org/bugzilla/show_bug.cgi?id=30978 --- Comment #1 from Dominique Martinet --- Relevant part of the fedora-devel thread at the time, justifying there'd be interest in distros: https://www.mail-archive.com/devel@lists.fedoraproject.org/msg166474.html (sorry for double-update, to

[Bug debuginfod/30978] New: debuginfod-client security: optionally(?) verify downloaded binaries

2023-10-17 Thread rfhn.fhbrrjnzeneqpf at noclue dot notk.org
Severity: normal Priority: P2 Component: debuginfod Assignee: unassigned at sourceware dot org Reporter: rfhn.fhbrrjnzeneqpf at noclue dot notk.org CC: elfutils-devel at sourceware dot org Target Milestone: --- This is mostly a follow-up of #25607