On Fri, 17 Jul 2026 18:07:40 +0200 Santiago Vila <[email protected]> wrote: > Patch 3 is incomplete and therefore wrong: Using sha256sum alone will > not work unless there is a matching file with the sha256sums of old > files, which your patch misses completely. To do it "right", one would > have to recalculate those hashes on the old files using the new > function, but given that there is no real security gain in doing so, > I'm not going to change it at this point. (People do not replace their > working /etc/profile file by another file having the same md5sum as an > old version just for fun).
I wrote a script to calculate the hash for the historic versions to add the version information to the Ubuntu file. I could easily rework that to produce the corresponding sha256sums. Are you open to such a patch? I don't see how the checksums in this case could become security relevant, but who knows? -- Benjamin Drung Debian & Ubuntu Developer
