diff --git a/en_US.ISO8859-1/books/porters-handbook/book.sgml b/en_US.ISO8859-1/books/porters-handbook/book.sgml index 0b233ecc08..171de7c8ab 100644 --- a/en_US.ISO8859-1/books/porters-handbook/book.sgml +++ b/en_US.ISO8859-1/books/porters-handbook/book.sgml @@ -10222,6 +10222,27 @@ IGNORE=POINTYHAT is not supported special need. + + Rerolling distfiles + + Sometimes the authors of software change the content of + released distfiles without changing the file's name. You have + to verify that the changes are official and have been performed + by the author. It has happened in the past that the distfile + was silently altered on the download servers with the intent + to cause harm or compromise end user security. + + Put the old distfile aside, download the new one, unpack + them and compare the content with &man.diff.1;. If you see + nothing suspicious, you can update distinfo. + Be sure to summarize the differences in your PR or commit log, + so that other people know that you have taken care to ensure + that nothing bad has happened. + + You might also want to contact the authors of the software + and confirm the changes with them. + + Necessary workarounds