Could / should checksecurity add a plugin to check the files in the
distribution against their checksums in /var/lib/dpkg/info/*.md5sums?
This provides an easy way to improve the security of the system a
little.  Maybe combined with a diffing mechanism to avoid reporting the
same discrepancies over and over.

Here is a simple script (in shell) to list files that have conflicting
md5sums from those in the package:

cat /var/lib/dpkg/info/*.md5sums |  while read md5 file; do if test
X`md5sum "/$file" | cut -d' ' -f1` == X$md5; then :; else echo $file;
fi; done

Or, you know
  /# md5sum -c var/lib/dpkg/info/devscripts.md5sums
  usr/bin/annotate-output: OK
  usr/bin/archpath: OK
  usr/bin/bts: OK
  usr/bin/build-rdeps: OK
  usr/bin/chdist: OK
  usr/bin/checkbashisms: OK
  usr/bin/cowpoke: OK
  usr/bin/cvs-debi: OK
  usr/bin/cvs-debrelease: OK
  usr/bin/cvs-debuild: OK
  usr/bin/dcmd: OK
  usr/bin/dd-list: OK
  usr/bin/deb-janitor: OK
  usr/bin/deb-reversion: OK
  usr/bin/deb-why-removed: OK
  usr/bin/debsign: OK
  usr/bin/debsnap: OK
  usr/bin/debuild: FAILED
  usr/share/perl5/Devscripts/Uscan/git.pm: OK
  usr/share/perl5/Devscripts/Uscan/http.pm: OK
  usr/share/perl5/Devscripts/Uscan/svn.pm: OK
  usr/share/perl5/Devscripts/Utils.pm: OK
  usr/share/perl5/Devscripts/Versort.pm: OK
  md5sum: WARNING: 1 computed checksum did NOT match

On Thu, 14 Nov 2024 13:07:50 +0100 =?utf-8?B?0L3QsNCx?= < nabijaczleweli@nabijaczleweli.xyz> wrote:

Doesnt the debsums package already provide this functionality?