Bug 130769

Summary:	dev-tex/europecv-20060123-r1: Security Violation: A file exists that is not in the manifest.
Product:	Gentoo Linux	Reporter:	Sandro Bonazzola (RETIRED) <sanchan>
Component:	[OLD] Printing	Assignee:	Martin Ehmsen (RETIRED) <ehmsen>
Status:	VERIFIED FIXED
Severity:	normal
Priority:	High
Version:	2006.0
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---

Description Sandro Bonazzola (RETIRED) gentoo-dev

2006-04-21 13:19:41 UTC

Please use repoman before commit. I've checked the cvs, the cause is files/digest-europecv-20060123 not included in the manifest.
And please, sign the manifest it's pretty easy to do and don't require so much work. 

# emerge -avl dev-tex/europecv

These are the packages that would be merged, in order:

Calculating dependencies... done!
[ebuild     U ] dev-tex/europecv-20060123-r1 [20060123] 0 kB

Total size of downloads: 0 kB

*europecv-20060123-r1

  20 Apr 2006; Martin Ehmsen <ehmsen@gentoo.org>
  +europecv-20060123-r1.ebuild:
  Upstream apparently choose to alter the package without bumping the version,
  so a new revision with the "new" version, bug #130160.

  08 Apr 2006; Simon Stelling <blubb@gentoo.org> europecv-20040603.ebuild:
  stable on amd64

  19 Mar 2006; Mark Loeser <halcy0n@gentoo.org> europecv-20060123.ebuild:
  Add DEPEND on app-arch/unzip


Do you want me to merge these packages? [Yes/No] y
>>> Emerging (1 of 1) dev-tex/europecv-20060123-r1 to /
!!! Security Violation: A file exists that is not in the manifest.
!!! File: files/digest-europecv-20060123

Comment 1 Martin Ehmsen (RETIRED) gentoo-dev

2006-04-22 06:49:42 UTC

(In reply to comment #0)
> Please use repoman before commit.

I _always_ do! Here is the relevant part of my .zhistory

: 1145561310:0;echangelog
: 1145561479:0;nano -w ChangeLog
: 1145561509:0;ebuild europecv-20060123-r1.ebuild digest
: 1145561524:0;repoman full
: 1145561542:0;repoman commit

> I've checked the cvs, the cause is
> files/digest-europecv-20060123 not included in the manifest.

That file should not exist, apprently I forgot to cvs remove both the old ebuild and the digest after I rm'ed them.
This is a mistake that repoman does not catch!

> And please, sign the manifest it's pretty easy to do and don't require so much
> work. 

I'll set it up when I have some more time later today... I think this should be fixed as quickly as possible.

Thanks for letting me know!

Comment 2 Sandro Bonazzola (RETIRED) gentoo-dev

2006-04-23 02:21:20 UTC

Thank you for the quick fix :-)