binaries grow overnight, but rpm -V does not catch the changes

Marcin Struzak marcin at struzak.com
Wed Jul 13 19:34:08 UTC 2005


I upgraded tripwire from tripwire-2.3.1-20.fdr.1.1.i386.rpm to tripwire-2.3.1-21.i386.rpm, the initial check caught the changes (which were then accepted), but then my nightly check caught again changes in the tripwire binaries.  Here is the jist of them (obviously the checksums and inodes changed as well):
  a.. /usr/sbin/siggen grew from 1240308 to 1246768
  b.. /usr/sbin/tripwire grew from 1779188 to 1785884
  c.. /usr/sbin/twadmin grew from 1609652 to 1616280
  d.. /usr/sbin/twprint grew from 1369780 to 1376428
Surprisingly, rpm -V tripwire only reports (expected) changes to policy and configuration files, and is happy about the binaries!  Files extracted manually from the original rpm show the same characteristics as the original install (the "from" values in the list above).  

I am suspecting prelink is the culprit (found entries for all of the above in /var/log/prelink.log), but that still does not explain why rpm -V is absolutely silent about the changes?  

--Marcin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/fedora-list/attachments/20050713/cfc5c240/attachment-0001.htm>


More information about the fedora-list mailing list