Re: [Savannah-hackers] Re: Plan for today

[Vincent Caron]

Mathieu Roy wrote:
> 1) I trust the latest CVS. I worked during the whole month of the
> compromise intensively with the CVS and I do not believe possible to
> miss an unnoticed harsh change in the CVS:
>      - I always check the diff for commits not made by myself
>      - A file that I did not change myself would produce at least and
>      "U" during a CVS update.

  In theory, a malicious hacker could change the RCS file in place 
without you noticing on cvs updates. Although that's very tricky and 
there are plenty of other places with easier and more insteresting 
backdoors to install.


> Also, if I remember well, Loic said that he checked and found nothing
> strange.

  I believe Loic did an audit too, someone has a trace of his 
confirmation ?


> (I insist on the fact that this kind of change must not be commited
> on the Savannah CVS itself)

  I suggest we set up a new CVS repository with an import from the 
TDEV_2003-09-05_CERN branch for the sake of subversions (we need the 
audit confirmation first for that, tapping code from nov 1st would 
deprive us of a lot of bugfixes). We can resync later and progressively 
with the official Savannah tree. Makes sense to you Mathieu ?