rpm5 package verification and md5sum of config files

[Jeffrey Johnson]

On Oct 22, 2012, at 6:44 AM, Jan Rękorajski wrote:

> 
> Rebuilding ~8500 packages is not an option, unfortunately :(
> 

Um … you managed to *build* ~8500 packages using a buggy
rpmbuild in rpm-5.4.10.

What makes *rebuilding* harder than building?

Note that not all 8500 packages are affected (only %config iirc).

>> * second, fix the verification process only, drop hmac support and do it
>>  the good old way.
> 
> Quick question, does passing '--nohmacs' option give the same effect as
> your patch to lib/verify.c? In that case we could just make it default
> and add '--hmacs' option.
> 

Implementing --nohmac as a disabler was the intent.

Meanwhile adding --nohmac, or patching rpm or counting the no of pkgs isn't
gointg to repair the headers that do not have the right flag bits.

And if you don't fix the metadata soon, then the problem will persist forever,
and need to be dealt with again and again, because the affected packages
will be deployed and nothing can change except wait 2-3y.

73 de Jeff