Subject: bug#19479: Package manager vulnerable

From: Stefan Kangas <[email-masked]>
Date: Tue, 8 Sep 2020 01:10:53 -0700

Noam Postavsky <[email-masked]> writes:

> I think the idea is that if the attacker has the signing key and sends
> out a bad version of archive-contents, it will be revealed as soon as
> the victim gets a "good" version, since its previous-version hash won't
> match.

Yes, this is what I understood to be the case as well.

> Except that only works if the user can expect to get all versions of
> archive-contents, so maybe I've missed something.

Exactly my point.  So we can't rely on it to bail out if the hashes
don't match up, I think.