Messages in this thread |  | | | Date | Wed, 5 Oct 2011 19:47:16 -0400 | | From | Ted Ts'o <> | | Subject | Re: kernel.org status: establishing a PGP web of trust |
| |
On Thu, Oct 06, 2011 at 12:25:26AM +0300, Adrian Bunk wrote: > > Had debsums told me that /bin/bash was modified I would have been quite > convinced. >
Keep in mind that debsums is trivially easy to circument. That just checks against an md5 checksum stored in a text file in /var/lib/dpkg/info/*.md5sums. If someone modified /bin/bash it would easy enough for them to modify the relevant md5sums file. - Ted
|  |