March 30 2022 - your windows binaries doe not create correct hash
(1) By anonymous on 2022-03-30 15:31:36 [link] [source]
Hi just an observation: on your website you post the following:
Precompiled Binaries for Windows sqlite-dll-win32-x86-3380200.zip (553.70 KiB) 32-bit DLL (x86) for SQLite version 3.38.2. (sha3: b61e859ff10f052ae078aefef9a8d783884b8c27eac0be099e15f65d74bbf59c) sqlite-dll-win64-x64-3380200.zip (994.42 KiB) 64-bit DLL (x64) for SQLite version 3.38.2. (sha3: 5f3a43c438cb4cc3ac56358e005c7f190105cdd5d3b02910b6818b1dde23f5c3) sqlite-tools-win32-x86-3380200.zip (1.87 MiB) A bundle of command-line tools for managing SQLite database files, including the command-line shell program, the sqldiff.exe program, and the sqlite3_analyzer.exe program. (sha3: 0e22e47873902388e3b26c3702fa3cd53ab3f29e315014d7fe25efb0aefbf6bf)
The downloaded 64-bit versions create a sha3-256 digest that is different:
C:SpielwieseOpenSSL-1.1.1h_win32>openssl dgst -sha3-256 C:Checksumsqlite-dll-win64-x64-3380200.zip SHA3-256(C:Checksumsqlite-dll-win64-x64-3380200.zip)= 9f71eec9a2c7f12602eaa2af76bd7c052e540502ae7a89dac540e10962e2fa35 and
C:SpielwieseOpenSSL-1.1.1h_win32>openssl dgst -sha3-256 C:Checksumsqlite-tools-win32-x86-3380200.zip SHA3-256(C:Checksumsqlite-tools-win32-x86-3380200.zip)= 0e22e47873902388e3b26c3702fa3cd53ab3f29e315014d7fe25efb0aefbf6bf
So your windows dll's are incorrect or you did not update the digest.
(3) By anonymous on 2022-03-31 10:56:51 in reply to 2 [source]
So you are saying that you on purpose create a doubt about the security of your windows 64-bit dll's that you post here. Or are you saying we know that we distribute compromised dll's?
(4) By Richard Hipp (drh) on 2022-03-31 11:16:48 in reply to 3 [link] [source]
There were complaints about the original pre-built binaries. So we rebuilt them. And there was a delay in between updating the binary and updating the website. But the two are in sync now. You apparently did your security checks after the ZIP archive was updated but before the website was updated.
(5) By Harald Hanche-Olsen (hanche) on 2022-03-31 11:44:01 in reply to 4 [link] [source]
I have to admit I never understood the security benefit of posting hashes so long as both the binary and the corresponding hash are published on the same site. If someone can substitute a malicious binary, presumably they have write access to the server. And then what is stopping them from changing the published hash as well?
If the binary is distributed via third parties, on the other hand, the hashes make a lot of sense.