CERT Advisory CA-2003-21 GNU Project FTP Server Compromise

[xray]

The GNU FTP server got compromised. http://www.cert.org/advisories/CA-2003-21.html

I think we must assume (in the worst case) that some ebuilds have digests with incorrect md5 hashes. if we assume that the ftp server carries only correct files now, a hash mismatch will occour and we will detect the corrupted ebuilds. however, this will only work if you dont have the corrupted files cached in /usr/portage/distfiles.

Do we have to clean /usr/portage/distfiles from all files comming from the GNU FTP site?
rm /usr/portage/distfiles/*

[bsolar]

There's this thread about this topic.
_________________
I may not agree with what you say, but I'll defend to the death your right to say it.