{"action":"created","issue":{"url":"https://api.github.com/repos/seveas/python-hpilo/issues/182","repository_url":"https://api.github.com/repos/seveas/python-hpilo","labels_url":"https://api.github.com/repos/seveas/python-hpilo/issues/182/labels{/name}","comments_url":"https://api.github.com/repos/seveas/python-hpilo/issues/182/comments","events_url":"https://api.github.com/repos/seveas/python-hpilo/issues/182/events","html_url":"https://github.com/seveas/python-hpilo/issues/182","id":317311866,"number":182,"title":"Include cryptographic checksum in firmware.conf","user":{"login":"ypid-geberit","id":36660054,"avatar_url":"https://avatars1.githubusercontent.com/u/36660054?v=4","gravatar_id":"","url":"https://api.github.com/users/ypid-geberit","html_url":"https://github.com/ypid-geberit","followers_url":"https://api.github.com/users/ypid-geberit/followers","following_url":"https://api.github.com/users/ypid-geberit/following{/other_user}","gists_url":"https://api.github.com/users/ypid-geberit/gists{/gist_id}","starred_url":"https://api.github.com/users/ypid-geberit/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ypid-geberit/subscriptions","organizations_url":"https://api.github.com/users/ypid-geberit/orgs","repos_url":"https://api.github.com/users/ypid-geberit/repos","events_url":"https://api.github.com/users/ypid-geberit/events{/privacy}","received_events_url":"https://api.github.com/users/ypid-geberit/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2018-04-24T16:53:47Z","updated_at":"2018-04-25T22:44:36Z","closed_at":"2018-04-25T22:44:36Z","author_association":"NONE","body":"This would be useful to ensure that the correct file was downloaded. Also, in cases proxies are used or the files are self hosted as mentioned in the docs, something could go wrong or an attach is performed.\r\n\r\nThe question would be from which file the checksum should be stored. I would propose the original scexe file because that allows to check the checksum (which is distributed separatly, by this repo) before parsing an potentially untrusted file.\r\n\r\nReason and Examples:\r\n\r\n* https://github.com/hamishcoleman/thinkpad-ec/blob/master/Descriptions.txt\r\n* https://github.com/rootkovska/codehash.db\r\n\r\nEffects:\r\n\r\n* https://github.com/seveas/python-hpilo/blob/master/firmware.conf\r\n* https://github.com/seveas/python-hpilo/blob/master/hpilo_fw.py"},"comment":{"url":"https://api.github.com/repos/seveas/python-hpilo/issues/comments/384457137","html_url":"https://github.com/seveas/python-hpilo/issues/182#issuecomment-384457137","issue_url":"https://api.github.com/repos/seveas/python-hpilo/issues/182","id":384457137,"user":{"login":"seveas","id":200649,"avatar_url":"https://avatars3.githubusercontent.com/u/200649?v=4","gravatar_id":"","url":"https://api.github.com/users/seveas","html_url":"https://github.com/seveas","followers_url":"https://api.github.com/users/seveas/followers","following_url":"https://api.github.com/users/seveas/following{/other_user}","gists_url":"https://api.github.com/users/seveas/gists{/gist_id}","starred_url":"https://api.github.com/users/seveas/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/seveas/subscriptions","organizations_url":"https://api.github.com/users/seveas/orgs","repos_url":"https://api.github.com/users/seveas/repos","events_url":"https://api.github.com/users/seveas/events{/privacy}","received_events_url":"https://api.github.com/users/seveas/received_events","type":"User","site_admin":true},"created_at":"2018-04-25T22:44:36Z","updated_at":"2018-04-25T22:44:36Z","author_association":"OWNER","body":"#184 doesn't help Debian unless they actually check the signature, and nothing tells me they do. It's also only one of the distribution channels, and unfortunately people will just add any old gpg key to the apt or yum/dnf keyring that they find these days.\r\n\r\nI'm afraid that the scaremongering about targeted attacks also doesn't work for me. Feel free to maintain a list of firmware hashes yourself, but I still don't think that the added work adds enough value to make it worth it."}}
{"actor":{"display_login":"seveas"}}