[ Thanks to Jim
Lynch for this link. ]
“You’ve likely heard this one already, but here it is again:
over the weekend, the UnrealIRCd team discovered the
‘Unreal3.2.8.1.tar.gz file on our mirrors has been replaced quite a
while ago with a version with a backdoor (trojan) in it.’“Still, from the looks of this news, mistakes were indeed made.
The Unreal team have already ‘fessed up to the fact that (until
this happened), archived releases had not been PGP/GPG signed.
Which means if the archived version of the software varied in any
way from the actual source code, there’s no sure way to tell.
That’s what signing is supposed to do.“The team also admitted to not checking all of the mirrored
files as often as they should have. Which means that while the true
source code (in CVS) was clean as a whistle, the source archive
files that people downloaded were not clean for a very long
time.”