KDE neon users may want to reinstall [LWN.net]

The KDE Project has a little problem to report for users of the KDE neon distribution: "The package archive used by KDE neon was incorrectly configured allowing anyone to upload packages to it. There is no reason to think that anyone actually did so but as a precaution we have emptied the archives and removed ISOs built before this date." Once the process of rebuilding the archive is complete, users are recommended to upgrade to the new versions, or, better, simply reinstall.

to post comments

KDE neon users may want to reinstall

Posted Nov 14, 2016 22:25 UTC (Mon) by welinder (guest, #4699) [Link] (7 responses)

That's a weird recommendation.

If no-one actually uploaded evil bits, then there is no need to reinstall.

If someone did, reinstallation of KDE is not a solution. Reinstallation of the entire machine together with cancellation of all private keys and passwords stored or used on the machine in the meantime. The works, in other words.

Perhaps they really ought to see if the packages *were* tampered with by means of recompilation and comparison. Or whatever else it takes.

KDE neon users may want to reinstall

Posted Nov 14, 2016 22:35 UTC (Mon) by amacater (subscriber, #790) [Link] (3 responses)

The article underneath might help - if KDE Neon were Debian rather than Ubuntu based, you could always rebuild it reproducibly and check it accordingly

KDE neon users may want to reinstall

Posted Nov 14, 2016 23:06 UTC (Mon) by smoogen (subscriber, #97) [Link] (2 responses)

Oh cool when did Debian reach 100% reproducibility? [Or even 90% reproducibility?] The web page https://wiki.debian.org/ReproducibleBuilds says:

Reproducible builds in Debian are still at the experimental stage. While we are making very good progress, it is a stretch to say that Debian is reproducible or even partially reproducible until the needed changes are integrated in the main distribution.

But the graph shows a pretty high amount of builds being reproducible.. is there some staleness or just that the graph does not convey some key issues?

KDE neon users may want to reinstall

Posted Nov 14, 2016 23:33 UTC (Mon) by amacater (subscriber, #790) [Link]

91% reproducible in Debian testing as of yesterday - see the mini-Debconf from Cambridge.

May not be complete for Stretch. Will also involve SUSE, Fedora, OpenWRT and other projects.

See: http://meetings-archive.debian.net/pub/debian-meetings/20...

KDE neon users may want to reinstall

Posted Nov 15, 2016 0:16 UTC (Tue) by Jonno (subscriber, #49613) [Link]

> Oh cool when did Debian reach 100% reproducibility? [Or even 90% reproducibility?]

Debian testing (aka stretch) reached 91% by October 1 [1], and is currently at 91.4% [2].

> The web page https://wiki.debian.org/ReproducibleBuilds says:
> Reproducible builds in Debian are still at the experimental stage. While we are making very good progress, it is a stretch to say that Debian is reproducible or even partially reproducible until the needed changes are integrated in the main distribution.

As usual the documentation isn't exactly up-to-date. The last piece needed was integrated into the main distribution at November 6 [3], only the infrastructure to publish the build environment specification online (so a third party can reproduce it) is still missing...

1: https://reproducible.alioth.debian.org/blog/posts/75/
2: https://tests.reproducible-builds.org/debian/testing/inde...
3: https://lists.debian.org/debian-dpkg/2016/11/msg00000.html

KDE neon users may want to reinstall

Posted Nov 15, 2016 4:45 UTC (Tue) by cjwatson (subscriber, #7322) [Link] (1 responses)

Surely they have audit logs of uploads? If not, that should be worrying in itself.

KDE neon users may want to reinstall

Posted Nov 15, 2016 11:47 UTC (Tue) by pboddie (guest, #50784) [Link]

I was just wondering what was actually there in the directories containing the packages. Did they look at the files and try and account for where they all came from, when they were uploaded, and so on, or did they just delete everything and tell everyone else to do the same? Also, aren't these things signed at some level?

KDE neon users may want to reinstall

Posted Nov 15, 2016 8:26 UTC (Tue) by FLHerne (guest, #105373) [Link]

'KDE neon' is a distribution (with a stock-KDE desktop, of course), so the recommendation is indeed to reinstall the whole thing.