A friend asked me, "How do you know that someone didn't replace your KNOPPIX compressed file system with a tainted one containing malware and such?"

I do verify portions of systems by appending a MD5 hash (plus a bit of arcania) to the end of some executables so that I can later verify they are the ones I supplied. The executables don't mind the extra 32 bytes,

But the clooped file system DOES seem to mind. I only hash as much as is needed to detect changes. I then append the MD5 hash and a time stamp to the end of the file.

I have been through the sourcecode in "cloop-2"; and not found anything that explicitly compares the end of compressed data with the file size. And I have compressed FSs with odd byte sizes, so there is no specific size multiple. So why the failures?

BillS

This is the result of loading and mounting a 'signed' compressed file.
Code:
root@lp2:/tmp# losetup /dev/cloop2 /tmp/KNOPPIX_NOV_29_04
root@lp2:/tmp# losetup -a
root@lp2:/tmp# head -4 KNOPPIX_NOV_29_04 
#!/bin/sh
#V2.0 Format
insmod cloop.o file=$0 && mount -r -t iso9660 /dev/cloop $1
exit $?
root@lp2:/tmp# mount -r -t iso9660 /dev/cloop2 /mnt/test
mount: wrong fs type, bad option, bad superblock on /dev/cloop2,
       or too many mounted file systems
And then the same file without the signature (simply lacking the 32 bytes):
Code:
root@lp2:/tmp# losetup /dev/cloop /extra/CompressedFS/KNOPPIX_NOV_29_04
root@lp2:/tmp# losetup -a
root@lp2:/tmp# mount -r -t iso9660 /dev/cloop /mnt/test
root@lp2:/tmp# losetup -a
root@lp2:/tmp# ls /mnt/test
bin   cdrom  etc     home  mnt   proc  sbin  tmp  var
boot  dev    floppy  lib   none  root  sys   usr  vmlinuz
root@lp2:/tmp# cmp KNOPPIX_NOV_29_04 /extra/CompressedFS/KNOPPIX_NOV_29_04
cmp: EOF on /extra/CompressedFS/KNOPPIX_NOV_29_04