[asterisk-users] change date

[Tilghman Lesher]

On Saturday 27 November 2010 04:52:31 Klaus Schwarzkopf wrote:
> Hi,
> 
> why have many files on
> http://downloads.asterisk.org/pub/telephony/asterisk/releases/ the
> change date 18 aug 2009? See:
> 
> asterisk-1.2.24-patch.gz	07-Aug-2007 17:10	3.2K
> asterisk-1.2.24-patch.gz.asc	07-Aug-2007 17:10	1.1K
> asterisk-1.2.24-patch.gz.sha1	07-Aug-2007 17:10	 67
> asterisk-1.2.24.tar.gz		18-Aug-2009 16:33	 28M
> asterisk-1.2.24.tar.gz.asc	18-Aug-2009 16:33	1.0K
> asterisk-1.2.24.tar.gz.sha1	18-Aug-2009 16:33	 65
> asterisk-1.2.25-patch.gz	29-Nov-2007 15:59	1.5K
> asterisk-1.2.25-patch.gz.asc	29-Nov-2007 15:59	567
> 
> 
> I try to repair the openembedded recipes an the recipe have also an
> different checksum.
> 
> NOTE: fetch
> http://downloads.asterisk.org/pub/telephony/asterisk/releases/asterisk-1
> .2.24.tar.gz NOTE: The checksums for
> '/home/klaus/development/oe/downloads/asterisk-1.2.24.tar.gz' did not
> match. Expected MD5: '63dc8b7be4cd10375c5fbda893c780bc' and Got:
> 'db7bcaaa494804af361157a37c224dfa'
> Expected SHA256:
> '9debaf410636fa477e1e1f09fe0b16a1c2814afaf7195f34f29e4ce5b8debbbd' and
> Got: 'eed3493b1409d7100e0f983af0486bd7f8965e9e47b7a6d5ab8539b2dd3609aa'
> NOTE: Your checksums:
> SRC_URI[md5sum] = "db7bcaaa494804af361157a37c224dfa"
> SRC_URI[sha256sum] =
> "eed3493b1409d7100e0f983af0486bd7f8965e9e47b7a6d5ab8539b2dd3609aa"

Due to a licensing issue with some of the files we distributed with previous 
tarballs, we removed those files from archived tarballs in order to avoid
continuing to distribute those files in any form.  So yes, the checksums
will have changed, although the checksums we distribute with the tarballs
were also updated at the same time.

Given that most of the changes since 1.2.24 have been security fixes, I
would strongly encourage you to update your packages.  There is no excuse
for distributing vulnerable packages beyond the date that the vulnerability
is disclosed, plus a brief period necessary for releasing updated packages.

Additionally, the 1.2 branch has been EOLed, which means if any additional
security issues are found, we will not be releasing updated packages to
deal with those issues.  For this reason, you would be better off putting
forth the work to release packages based upon 1.4 or 1.8.

-- 
Tilghman Lesher
Digium, Inc. | Senior Software Developer
twitter: Corydon76 | IRC: Corydon76-dig (Freenode)
Check us out at: www.digium.com & www.asterisk.org