harden-doc 3.19 - en to pt_BR translation catalogue (69 entries)

en: Debian Security Infrastructure
pt_BR: Infraestrutura do Debian Security

en: The Debian Security Team
pt_BR: O time Debian Security

en: Debian has a Security Team, that handles security in the <emphasis>stable</emphasis> distribution. Handling security means they keep track of vulnerabilities that arise in software (watching forums such as Bugtraq, or vuln-dev) and determine if the <emphasis>stable</emphasis> distribution is affected by it.
pt_BR: O Debian tem um Security Team (Time de Segurança), composto por cinco membros e duas secretárias que manipulam a segurança na distribuição <emphasis>stable</emphasis> (estável). Manipular a segurança significa que eles acompanham as vulnerabilidades que aparecem nos software (vendo foruns como bugtraq o vuln-dev) e determinam se a distribuição <emphasis>stable</emphasis> é afetada por eles.

en: Sensitive information should be sent to the first address and, in some cases, should be encrypted with the Debian Security Contact key (as found in the Debian keyring).
pt_BR: Informações sensíveis devem ser enviadas para o primeiro email e, em alguns casos, deve ser encriptada com a Debian Security Contact key (key ID 363CCD95).

en: Once a probable problem is received by the Security Team it will investigate if the <emphasis>stable</emphasis> distribution is affected and if it is, a fix is made for the source code base. This fix will sometimes include backporting the patch made upstream (which usually is some versions ahead of the one distributed by Debian). After testing of the fix is done, new packages are prepared and published in the <ulink url="http://security.debian.org" /> site so they can be retrieved through <command>apt</command> (see <xref linkend="security-update" />). At the same time a <emphasis>Debian Security Advisory</emphasis> (DSA) is published on the web site and sent to public mailing lists including <ulink name="debian-security-announce" url="http://lists.debian.org/debian-security-announce" /> and Bugtraq.
pt_BR: Quando um provável problema for recebido pelo Security Team, ele investigará se a distribuição <emphasis>stable</emphasis> foi afetada e, caso positivo, uma correção será feita no código fonte base. Esta correção algumas vezes incluirá algum patch (que normalmente é mais recente que a versão distribuída pelo Debian). Após o teste da correção, novos pacotes são preparados e publicados em <ulink url="security.debian.org" /> e podem ser baixados com o <command>apt</command> (veja <xref linkend="security-update" />). Ao mesmo tempo um <emphasis>Debian Security Advisory</emphasis> (DSA) é publicado no web site e enviado para a listas de email incluindo <ulink url="lists.debian.org/debian-security-announce" name="debian-security-announce" /> e bugtraq.

en: Some other frequently asked questions on the Debian Security Team can be found at <xref linkend="debian-sec-team-faq" />.
pt_BR: Outras perguntas frequentes do Debian Security Team podems er encontradas em <xref linkend="debian-sec-team-faq" />.

en: Debian Security Advisories (DSAs) are made whenever a security vulnerability is discovered that affects a Debian package. These advisories, signed by one of the Security Team members, include information of the versions affected as well as the location of the updates. This information is:
pt_BR: Debian Security Advisories são avisos emitidos quandos uma vulnerabilidade de segurança que afeta um pacote Debian é descoberta. Estes avisos, assinados por um membro do Security Team, inclui informação das versões afetadas assim como a localização das atualizações e seus MD5sums. Esta informação consiste de:

en: version number for the fix.
pt_BR: número da versão para correção.

en: problem type.
pt_BR: tipo de problema.

en: whether it is remote or locally exploitable.
pt_BR: se ele é remoto ou localmente explorável.

en: short description of the package.
pt_BR: pequena descriçãod do pacote.

en: description of the problem.
pt_BR: descrição do problema.

en: description of the exploit.
pt_BR: descrição da exploração.

en: description of the fix.
pt_BR: descrição da correção.

en: Interested users can, however (and this is done in some Debian-related portals) use the RDF channel to download automatically the DSAs to their desktop. Some applications, such as <command>Evolution</command> (an email client and personal information assistant) and <command>Multiticker</command> (a GNOME applet), can be used to retrieve the advisories automatically. The RDF channel is available at <ulink url="http://www.debian.org/security/dsa.rdf" />.
pt_BR: Usuários interessados podem, porém, usar o canal RDF para baixar automaticamente as DSAs para seu computador. Algumas aplicações, como o <command>Evolution</command> (um cliente de email e assistente de informações pessoais) e o <command>Multiticker</command> (um applet do GNOME), podem ser usados para baixar os avisos automaticamente. O canal RDF está disponível em <ulink url="http://www.debian.org/security/dsa.rdf" />.

en: DSAs published on the website might be updated after being sent to the public-mailing lists. A common update is adding cross references to security vulnerability databases. Also, translations<footnote><para>Translations are available in up to ten different languages.</para></footnote> of DSAs are not sent to the security mailing lists but are directly included in the website.
pt_BR: Os DSAs publicados no website podem ser atualizados após enviados para as listas de email. Uma atualização comum é adicionada através de referências ao banco de dados de vulnerabilidades de segurança. Além disso, traduções <footnote><para>Traduções estão disponíveis em dez idiomas</para></footnote> dos DSAs não são enviadas para as listas de email mas são diretamente incluídas no site.

en: Vulnerability cross references
pt_BR: Referências sobre vulnerabilidades

en: Debian provides a fully <ulink name="crossreferenced table" url="http://www.debian.org/security/crossreferences" /> including all the references available for all the advisories published since 1998. This table is provided to complement the <ulink name="reference map available at CVE" url="http://cve.mitre.org/cve/refs/refmap/source-DEBIAN.html" />.
pt_BR: Debian fornece uma referência completa em <ulink name="crossreferenced table" url="http://www.debian.org/security/crossreferences" /> incluindo todas as remomendações publicadas desde 1998. Esta tabela é fornecida em complemento a <ulink url="http://cve.mitre.org/cve/refs/refmap/source-DEBIAN.html" name="reference map available at CVE" />.

en: You will notice that this table provides references to security databases such as <ulink name="Bugtraq" url="http://www.securityfocus.com/bid" />, <ulink name="CERT/CC Advisories" url="http://www.cert.org/advisories/" /> and <ulink name="US-CERT Vulnerability Notes Database" url="http://www.kb.cert.org/vuls" /> as well as CVE names (see below). These references are provided for convenience use, but only CVE references are periodically reviewed and included.
pt_BR: Você notará que esta tabela fornece referências aos bancos de dados como <ulink name="Bugtraq" url="http://www.securityfocus.com/bid" />, <ulink name="CERT/CC Advisories" url="http://www.cert.org/advisories/" /> and <ulink url="http://www.kb.cert.org/vuls" name="US-CERT Vulnerability Notes Database" /> assim como aos nomes CVE (veja abaixo). Estas referências são fornecidas para uso, porém apenas referências CVE são periodicamente revisadas e incluídas. Este recurso foi adicionado ao website em junho de 2002.

en: Advantages of adding cross references to these vulnerability databases are:
pt_BR: Uma das vantagens de adicionar referências ao banco de dados de vulnerabilidades é que:

en: it makes it easier for Debian users to see and track which general (published) advisories have already been covered by Debian.
pt_BR: torna fácil aos usuários Debian ver e tratar com recomendações publicadas que já tenham sido resolvidas pelo Debian.

en: system administrators can learn more about the vulnerability and its impact by following the cross references.
pt_BR: administradores de sistema podem aprender mais sobre vulnerabilidades e seu impacto através das referências.

en: this information can be used to cross-check output from vulnerability scanners that include references to CVE to remove false positives (see <xref linkend="vulnasses-false-positive" />).
pt_BR: esta informação pode ser usada para a checagem de vulnerabilidades referentes ao CVE e detectar avisos falsos. (veja <xref linkend="vulnasses-false-positive" />).

en: CVE compatibility
pt_BR: Compatibilidade CVE

en: Debian Security Advisories were <ulink name="declared CVE-Compatible" url="http://www.debian.org/security/CVE-certificate.jpg" /><footnote><para>The full <ulink name="capability questionnaire" url="http://cve.mitre.org/compatible/phase2/SPI_Debian.html" /> is available at CVE</para></footnote> in February 24, 2004.
pt_BR: As recomendações de segurança, Debian Security Advisories eram <ulink url="http://www.debian.org/security/CVE-certificate.jpg" name="declared CVE-Compatible" /><footnote><para>O completo <ulink name="capability questionnaire" url="http://cve.mitre.org/compatible/phase2/SPI_Debian.html" /> estava disponível para o CVE </para></footnote> em fevereiro de 2004.

en: The <ulink name="Common Vulnerabilities and Exposures (CVE)" url="http://cve.mitre.org" /> project is maintained by the MITRE Corporation and provides a list of standardized names for vulnerabilities and security exposures.
pt_BR: O projeto <ulink name="Common Vulnerabilities and Exposures (CVE)" url="http://cve.mitre.org" /> é mantido pela MITRE Corporation e fornece uma lista de nomes padronizados para vulnerabilidades e exposições de segurança.

en: Debian believes that providing users with additional information related to security issues that affect the Debian distribution is extremely important. The inclusion of CVE names in advisories help users associate generic vulnerabilities with specific Debian updates, which reduces the time spent handling vulnerabilities that affect our users. Also, it eases the management of security in an environment where CVE-enabled security tools -such as network or host intrusion detection systems, or vulnerability assessment tools- are already deployed regardless of whether or not they are based on the Debian distribution.
pt_BR: Debian acredita que fornecer aos usuários informações relacionadas a segurança que afetem a distribuição é extremamente importante. A inclusão dos nomes CVE em avisos ajudam os usuários a associar vulnerabilidades genéricas com atualizações específicas, com redução do tempo gasto para manusear as vulnerabilidades. Além disso, é fácil o gerenciamento da segurança em um ambiente onde já existem ferramentas que utilizam o CVE, como redes ou sistemas de deteccão de invasão, ou ferramentas de avalição de vulnerabilidades, mesmo que elas não sejam baseadas em uma distribuição Debian.

en: In some cases you might not find a given CVE name in published advisories, for example because:
pt_BR: Em alguns casos você pode nãO encontrar um CVE em avisos publicados porque:

en: No Debian products are affected by that vulnerability.
pt_BR: No Debian os produtos não são afetados pela vulnerabilidades.

en: There is not yet an advisory covering that vulnerability (the security issue might have been reported as a <ulink name="security bug" url="http://bugs.debian.org/cgi-bin/pkgreport.cgi?tag=security" /> but a fix has not been tested and uploaded).
pt_BR: Ainda não existe uma viso abordando a vulnerabilidade (ele pode ter sido informado para a <ulink url="http://bugs.debian.org/cgi-bin/pkgreport.cgi?tag=security" name="security bug" /> mas uma correção ainda não ter sido testada a atualizada)

en: An advisory was published before a CVE name was assigned to a given vulnerability (look for an update at the web site).
pt_BR: Um aviso foi publicado antes que um CVE fosse assinado para a vulnerabilidade em questão (procure por uma atualização no web site)

en: Debian Security Build Infrastructure
pt_BR: Infraestrutura da segurança Debian

en: Since Debian is currently supported in a large number of architectures, administrators sometimes wonder if a given architecture might take more time to receive security updates than another. As a matter of fact, except for rare circumstances, updates are available to all architectures at the same time.
pt_BR: Uma vez que o Debian é normalmente suportado em um grande número de arquiteturas, administradores algumas ficam admirados se uma dada arquitetura levar mais tempo para receber atualizações de segurança. De fato, exceto em raras circunstâncias, atualizações estão disponíveis para todas as arquiteturas ao mesmo tempo.

en: Someone finds a security problem.
pt_BR: Alguém encontra um problema de segurança.

en: Someone fixes the problem, and makes an upload to security-master.debian.org's incoming (this <emphasis>someone</emphasis> is usually a Security Team member but can be also a package maintainer with an appropriate fix that has contacted the Security Team previously). The Changelog includes a <emphasis>testing-security</emphasis> or <emphasis>stable-security</emphasis> as target distribution.
pt_BR: Alguém corrige o problema e atualiza security.debian.org (este <emphasis>alguém</emphasis> normalmente é um membro do Time de Segurança mas pode ser também um mantenedor de pacote com uma correção apropriada que contactou o time de segurança previamente). O Changelog inclui uma indicação <emphasis>testing-security</emphasis> ou <emphasis>stable-security</emphasis>.

en: The upload gets checked and processed by a Debian system and moved into queue/accepted, and the buildds are notified. Files in here can be accessed by the security team and (somewhat indirectly) by the buildds.
pt_BR: Ocorre o upload checado e processado por um sistema Debian e movido para queue/accepted, e buildds são notificados. Arquivos aqui podem ser acessados pelo time de segurança e (indiretamente) pelos buildds.

en: Security-enabled buildds pick up the source package (prioritized over normal builds), build it, and send the logs to the security team.
pt_BR: O Security-enable buildds pega o pacote fonte (que tem prioridade sobre os builds normais), o constrói, e envia logs para o time de segurança.

en: The security team reply to the logs, and the newly built packages are uploaded to queue/unchecked, where they're processed by a Debian system, and moved into queue/accepted.
pt_BR: O time de segurança reproduz os logs, e novos pacotes construídos são enviados para queue/unchecked, onde são processados pelo sistema Debian, e movidos para queue/accepted.

en: When the security team find the source package acceptable (i.e., that it's been correctly built for all applicable architectures and that it fixes the security hole and doesn't introduce new problems of its own) they run a script which:
pt_BR: Quando o time de segurança verifica que o pacote fonte está aceitável (isto é, ele foi corretamente construído para todas as arquiteturas, corrigiu os problemas de segurança e não introduziu novos problemas) eles rodam um script que:

en: installs the package into the security archive.
pt_BR: instala o pacote em um arquivo de segurança.

en: sets up a template advisory that the security team can finish off.
pt_BR: configura um aviso modelo que o time de seguranaça pode encerrar os trabalhos.

en: forwards the packages to the appropriate proposed-updates so that it can be included in the real archive as soon as possible.
pt_BR: (opcionalmente) envia os pacotes para as atualizações adequadas e eles podem ser incluídos assim que for possível.

en: This procedure, previously done by hand, was tested and put through during the freezing stage of Debian 3.0 woody (July 2002). Thanks to this infrastructure the Security Team was able to have updated packages ready for the apache and OpenSSH issues for all the supported (almost twenty) architectures in less than a day.
pt_BR: Este procedimento, antes feito a mão, foi testado e usado completamente durante o estágio freeze do Debian 3.0 Woody (Julho de 2002). Graças a esta infraestrutura do Security Team foi possível ter pacotes atualizados prontos para o apache e OpenSSH para todas as arquiteturas suportadas (quase vinte) em menos de um dia.

en: Developer's guide to security updates
pt_BR: Guia dos desenvolvedores de atualizações de seguranaça

en: Package signing in Debian
pt_BR: Assinatura de pacote no Debian

en: This section could also be titled "how to upgrade/update safely your Debian GNU/Linux system" and it deserves its own section basically because it is an important part of the Security Infrastructure. Package signing is an important issue since it avoids tampering of packages distributed in mirrors and of downloads with man-in-the-middle attacks. Automatic software update is an important feature but it's also important to remove security threats that could help the distribution of trojans and the compromise of systems during updates <footnote><para>Some operating systems have already been plagued with automatic-updates problems such as the <ulink name="Mac OS X Software Update vulnerabity" url="http://www.cunap.com/~hardingr/projects/osx/exploit.html" />.</para></footnote>
pt_BR: Esta seção também pode ser chamada "como atualizar seu sistema Debian GNU/Linux em segurança" e mereçe sua própria seção basicamente porque é uma parte importante da infraestrutura de segurança. Assinatura de pacote é uma coisa importante porque evita alterações de pacotes distribuídos em mirros. Atualização automatica de software é um recurso importante mas também é importante remover ameaças de segurança que poderiam ajudar a distribuir cavalos de tróia e comprometer os sistemas durante as atualizações. <footnote><para>Alguns sistemas operacionais já tiveram problemas com atualizações automáticas como <ulink name="Mac OS X Software Update vulnerabity" url="http://www.cunap.com/~hardingr/projects/osx/exploit.html" />.</para><para>FIXME: probably the Internet Explorer vulnerability handling certificate chains has an impact on security updates on Microsoft Windows.</para></footnote>.

en: The current scheme for package signature checks
pt_BR: O esquema proposto para checagem de assinatura dos pacotes

en: The current scheme for package signature checking using <command>apt</command> is:
pt_BR: O esquema atual para checagem da assinatura dos pacotes usando <command>apt</command> é:

en: the <filename>Release</filename> file includes the MD5 sum of <filename>Packages.gz</filename> (which contains the MD5 sums of packages) and will be signed. The signature is one of a trusted source.
pt_BR: o arquivo lançado incluirá o md5sum do Packages.gz (que contém os md5sum dos pacotes) e será assinado. A assinatura é de uma fonte certificada.

en: This signed <filename>Release</filename> file is downloaded by 'apt-get update' and stored along with <filename>Packages.gz</filename>.
pt_BR: A arquivo assinado é baixado pelo 'apt-get update' a armazenado com o Packages.gz.

en: When a package is going to be installed, it is first downloaded, then the MD5 sum is generated.
pt_BR: Quando o pacote está sendo instalado, ele primeiro é baixado, então o md5sum é gerado.

en: The signed <filename>Release</filename> file is checked (signature ok) and it extracts from it the MD5 sum for the <filename>Packages.gz</filename> file, the <filename>Packages.gz</filename> checksum is generated and (if ok) the MD5 sum of the downloaded package is extracted from it.
pt_BR: A assinatura é checada (assinatura ok) e extraído o md5sum do arquivo Pakages.gz, este por sua vez é gerado e (se ok) o md5sum do pacote baixado é extraído.

en: If the MD5 sum from the downloaded package is the same as the one in the <filename>Packages.gz</filename> file the package will be installed, otherwise the administrator will be alerted and the package will be left in the cache (so the administrator can decide whether to install it or not). If the package is not in the <filename>Packages.gz</filename> and the administrator has configured the system to only install checked packages it will not be installed either.
pt_BR: Se o md5sum do pacote baixado é o mesmo que o do Packages.gz, o pacote será instalado. Caso contrário o administrador será alertado e o pacote será colocado num cache (e o administrador pode decidir se instalará o pacote ou não). Se o pacote não estiver no Packages.gz e o administrador tiver configurado o sistema para só instalar pacotes checados, o pacote não será instalado.

en: By following the chain of MD5 sums <command>apt</command> is capable of verifying that a package originates from a a specific release. This is less flexible than signing each package one by one, but can be combined with that scheme too (see below).
pt_BR: A sequência seguinte de checagens MD5 do <command>apt</command> é capaz de verificar se o pacote origina de um release específico. Isto é menos flexível que a assinatura de cada pacote, mas pode ser combinada com este esquema também (veja abaixo).

en: Package signing has been discussed in Debian for quite some time, for more information you can read: <ulink url="http://www.debian.org/News/weekly/2001/8/" /> and <ulink url="http://www.debian.org/News/weekly/2000/11/" />.
pt_BR: Assinatura de pacotes foi discutido no Debian por um bom tempo, para mais informações leia: <ulink url="http://www.debian.org/News/weekly/2001/8/" /> e <ulink url="http://www.debian.org/News/weekly/2000/11/" />.

en: In case you want to add now the additional security checks and don't want or cannot run the latest apt version<footnote><para>Either because you are using the stable, <emphasis>sarge</emphasis>, release or an older release or because you don't want to use the latest apt version, although we would really appreciate testing of it.</para></footnote> you can use the script below, provided by Anthony Towns. This script can automatically do some new security checks to allow the user to be sure that the software s/he's downloading matches the software Debian's distributing. This stops Debian developers from hacking into someone's system without the accountability provided by uploading to the main archive, or mirrors mirroring something almost, but not quite like Debian, or mirrors providing out of date copies of unstable with known security problems.
pt_BR: Caso você queira adicionar os novos recursos de checagem de segurança e não queira rodar a versão experimental do apt (embora nõs realmente apreciemos o teste dele) você pode usar o script abaixo, fornecido por Anthony Towns. Este script pode automaticamente fazer algumas novas checagens de segurança para permitir ao usuário certificar-se que o software que está baixando corresponde aquele distribuído pelo Debian. Isto é para desenvolvedores Debian usarem em sistemas sem a funcionalidade de uploading dos sistemas tradicionais, ou mirrors que tem quase tudo mas não como o Debian, ou mirrors que fornecem dados da versão unstable sem conhecimento dos problemas de segurança.

en: This sample code, renamed as <command>apt-check-sigs</command>, should be used in the following way:
pt_BR: Este código, renomeado como <command>apt-check-sigs</command>, deve ser usado da seguinte maneira:

en: 
    # apt-get update
    # apt-check-sigs
    (...results...)
    # apt-get dist-upgrade
pt_BR: 
    # apt-get update
    # apt-check-sigs
    (...resultados...)
    # apt-get dist-upgrade

en: First you need to:
pt_BR: Primeiro você precisa:

en: remove any <filename>/etc/apt/sources.list</filename> lines that don't use the normal "dists" structure, or change the script so that it works with them.
pt_BR: remover qualquer linha do <filename>/etc/apt/sources.list</filename> que não usa a estrutura normal de "dist", ou alterar o script para ele trabalhe com elas.

en: be prepared to ignore the fact that Debian security updates don't have signed <filename>Release</filename> files, and that <filename>Sources</filename> files don't have appropriate checksums in the <filename>Release</filename> file (yet).
pt_BR: estar preparado para ignorar o fato que o Debian security updates não assinou os Release files, e que os Sources files não tem os checksums apropriados no Release file (ainda).

en: be prepared to check that the appropriate sources are signed by the appropriate keys.
pt_BR: estar preparado para checar se as fontes estão assinadas com as chaves apropriadas.

en: 
    #!/bin/bash
    
    # Copyright (c) 2001 Anthony Towns &lt;ajt@debian.org&gt;
    #
    # This program is free software; you can redistribute it and/or modify
    # it under the terms of the GNU General Public License as published by
    # the Free Software Foundation; either version 2 of the License, or
    # (at your option) any later version.
    #
    # This program is distributed in the hope that it will be useful,
    # but WITHOUT ANY WARRANTY; without even the implied warranty of
    # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    # GNU General Public License for more details.
    
    rm -rf /tmp/apt-release-check
    mkdir /tmp/apt-release-check || exit 1
    cd /tmp/apt-release-check
    
    &gt;OK
    &gt;MISSING
    &gt;NOCHECK
    &gt;BAD
    
    arch=`dpkg --print-installation-architecture`
    
    am_root () {
            [ `id -u` -eq 0 ]
    }
    
    get_md5sumsize () {
            cat "$1" | awk '/^MD5Sum:/,/^SHA1:/' | 
              MYARG="$2" perl -ne '@f = split /\s+/; if ($f[3] eq $ENV{"MYARG"}) {
    print "$f[1] $f[2]\n"; exit(0); }'
    }
    
    checkit () {
            local FILE="$1"
            local LOOKUP="$2"
    
            Y="`get_md5sumsize Release "$LOOKUP"`"
            Y="`echo "$Y" | sed 's/^ *//;s/  */ /g'`"
    
            if [ ! -e "/var/lib/apt/lists/$FILE" ]; then
                    if [ "$Y" = "" ]; then
                            # No file, but not needed anyway
                            echo "OK"
                            return
                    fi
                    echo "$FILE" &gt;&gt;MISSING
                    echo "MISSING $Y"
                    return
            fi
            if [ "$Y" = "" ]; then
                    echo "$FILE" &gt;&gt;NOCHECK
                    echo "NOCHECK"
                    return
            fi
            X="`md5sum &lt; /var/lib/apt/lists/$FILE | cut -d\  -f1` `wc -c &lt; /var/lib
    /apt/lists/$FILE`"
            X="`echo "$X" | sed 's/^ *//;s/  */ /g'`"
            if [ "$X" != "$Y" ]; then
                    echo "$FILE" &gt;&gt;BAD
                    echo "BAD"
                    return
            fi
            echo "$FILE" &gt;&gt;OK
            echo "OK"
    }
    
    echo
    echo "Checking sources in /etc/apt/sources.list:"
    echo "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"
    echo
    (echo "You should take care to ensure that the distributions you're downloading
    "
    echo "are the ones you think you are downloading, and that they are as up to"
    echo "date as you would expect (testing and unstable should be no more than"
    echo "two or three days out of date, stable-updates no more than a few weeks"
    echo "or a month)."
    ) | fmt
    echo
    
    cat /etc/apt/sources.list | 
      sed 's/^ *//' | grep '^[^#]' |
      while read ty url dist comps; do
            if [ "${url%%:*}" = "http" -o "${url%%:*}" = "ftp" ]; then
                    baseurl="${url#*://}"
            else
                    continue
            fi
    
            echo "Source: ${ty} ${url} ${dist} ${comps}"
    
            rm -f Release Release.gpg
            lynx -reload -dump "${url}/dists/${dist}/Release" &gt;/dev/null 2&gt;&amp;1
            wget -q -O Release "${url}/dists/${dist}/Release"
    
            if ! grep -q '^' Release; then
                    echo "  * NO TOP-LEVEL Release FILE"
                    &gt;Release
            else
                    origline=`sed -n 's/^Origin: *//p' Release | head -1`
                    lablline=`sed -n 's/^Label: *//p' Release | head -1`
                    suitline=`sed -n 's/^Suite: *//p' Release | head -1`
                    codeline=`sed -n 's/^Codename: *//p' Release | head -1`
                    dateline=`grep "^Date:" Release | head -1`
                    dscrline=`grep "^Description:" Release | head -1`
                    echo "  o Origin: $origline/$lablline"
                    echo "  o Suite: $suitline/$codeline"
                    echo "  o $dateline"
                    echo "  o $dscrline"
    
                    if [ "${dist%%/*}" != "$suitline" -a "${dist%%/*}" != "$codeline" ]; then
                            echo "  * WARNING: asked for $dist, got $suitline/$codeline"
                    fi
    
                    lynx -reload -dump "${url}/dists/${dist}/Release.gpg" &gt;/dev/null 2&gt;&amp;1
                    wget -q -O Release.gpg "${url}/dists/${dist}/Release.gpg"
    
                    gpgv --status-fd 3 Release.gpg Release 3&gt;&amp;1 &gt;/dev/null 2&gt;&amp;1 | sed -n "s/^\[GNUPG:\] //p" | (okay=0; err=""; while read gpgcode rest; do
                            if [ "$gpgcode" = "GOODSIG" ]; then
                                if [ "$err" != "" ]; then
                                    echo "  * Signed by ${err# } key: ${rest#* }"
                                else
                                    echo "  o Signed by: ${rest#* }"
                                    okay=1
                                fi
                                err=""
                            elif [ "$gpgcode" = "BADSIG" ]; then
                                echo "  * BAD SIGNATURE BY: ${rest#* }"
                                err=""
                            elif [ "$gpgcode" = "ERRSIG" ]; then
                                echo "  * COULDN'T CHECK SIGNATURE BY KEYID: ${rest %% *}"
                                err=""
                            elif [ "$gpgcode" = "SIGREVOKED" ]; then
                                err="$err REVOKED"
                            elif [ "$gpgcode" = "SIGEXPIRED" ]; then
                                err="$err EXPIRED"
                            fi
                        done
                        if [ "$okay" != 1 ]; then
                            echo "  * NO VALID SIGNATURE"
                            &gt;Release
                        fi)
            fi
            okaycomps=""
            for comp in $comps; do
                    if [ "$ty" = "deb" ]; then
                            X=$(checkit "`echo "${baseurl}/dists/${dist}/${comp}/binary-${arch}/Release" | sed 's,//*,_,g'`" "${comp}/binary-${arch}/Release")
                            Y=$(checkit "`echo "${baseurl}/dists/${dist}/${comp}/binary-${arch}/Packages" | sed 's,//*,_,g'`" "${comp}/binary-${arch}/Packages")
                            if [ "$X $Y" = "OK OK" ]; then
                                    okaycomps="$okaycomps $comp"
                            else
                                    echo "  * PROBLEMS WITH $comp ($X, $Y)"
                            fi
                    elif [ "$ty" = "deb-src" ]; then
                            X=$(checkit "`echo "${baseurl}/dists/${dist}/${comp}/source/Release" | sed 's,//*,_,g'`" "${comp}/source/Release")
                            Y=$(checkit "`echo "${baseurl}/dists/${dist}/${comp}/source/Sources" | sed 's,//*,_,g'`" "${comp}/source/Sources")
                            if [ "$X $Y" = "OK OK" ]; then
                                    okaycomps="$okaycomps $comp"
                            else
                                    echo "  * PROBLEMS WITH component $comp ($X, $Y)"
                            fi
                    fi
            done
            [ "$okaycomps" = "" ] || echo "  o Okay:$okaycomps"
            echo
      done
    
    echo "Results"
    echo "~~~~~~~"
    echo
    
    allokay=true
    
    cd /tmp/apt-release-check
    diff &lt;(cat BAD MISSING NOCHECK OK | sort) &lt;(cd /var/lib/apt/lists &amp;&amp; find . -type f -maxdepth 1 | sed 's,^\./,,g' | grep '_' | sort) | sed -n 's/^&gt; //p' &gt;UNVALIDATED
    
    cd /tmp/apt-release-check
    if grep -q ^ UNVALIDATED; then
        allokay=false
        (echo "The following files in /var/lib/apt/lists have not been validated."
        echo "This could turn out to be a harmless indication that this script"
        echo "is buggy or out of date, or it could let trojaned packages get onto"
        echo "your system."
        ) | fmt
        echo
        sed 's/^/    /' &lt; UNVALIDATED
        echo
    fi
    
    if grep -q ^ BAD; then
        allokay=false
        (echo "The contents of the following files in /var/lib/apt/lists does not"
        echo "match what was expected. This may mean these sources are out of date,"
        echo "that the archive is having problems, or that someone is actively"
        echo "using your mirror to distribute trojans."
        if am_root; then 
            echo "The files have been renamed to have the extension .FAILED and"
            echo "will be ignored by apt."
            cat BAD | while read a; do
                mv /var/lib/apt/lists/$a /var/lib/apt/lists/${a}.FAILED
            done
        fi) | fmt
        echo
        sed 's/^/    /' &lt; BAD
        echo
    fi
    
    if grep -q ^ MISSING; then
        allokay=false
        (echo "The following files from /var/lib/apt/lists were missing. This"
        echo "may cause you to miss out on updates to some vulnerable packages."
        ) | fmt
        echo
        sed 's/^/    /' &gt; MISSING
        echo
    fi
    
    if grep -q ^ NOCHECK; then
        allokay=false
        (echo "The contents of the following files in /var/lib/apt/lists could not"
        echo "be validated due to the lack of a signed Release file, or the lack"
        echo "of an appropriate entry in a signed Release file. This probably"
        echo "means that the maintainers of these sources are slack, but may mean"
        echo "these sources are being actively used to distribute trojans."
        if am_root; then 
            echo "The files have been renamed to have the extension .FAILED and"
            echo "will be ignored by apt."
            cat NOCHECK | while read a; do
                mv /var/lib/apt/lists/$a /var/lib/apt/lists/${a}.FAILED
            done
        fi) | fmt
        echo
        sed 's/^/    /' &gt; NOCHECK
        echo
    fi
    
    if $allokay; then
        echo 'Everything seems okay!'
        echo
    fi
    
    rm -rf /tmp/apt-release-check
pt_BR: 
    #!/bin/bash
    
    # Copyright (c) 2001 Anthony Towns &lt;ajt@debian.org&gt;
    #
    # This program is free software; you can redistribute it and/or modify
    # it under the terms of the GNU General Public License as published by
    # the Free Software Foundation; either version 2 of the License, or
    # (at your option) any later version.
    #
    # This program is distributed in the hope that it will be useful,
    # but WITHOUT ANY WARRANTY; without even the implied warranty of
    # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    # GNU General Public License for more details.
    
    rm -rf /tmp/apt-release-check
    mkdir /tmp/apt-release-check || exit 1
    cd /tmp/apt-release-check
    
     />OK
     />MISSING
     />NOCHECK
     />BAD
    
    arch=`dpkg --print-installation-architecture`
    
    am_root () {
            [ `id -u` -eq 0 ]
    }
    
    get_md5sumsize () {
            cat "$1" | awk '/^MD5Sum:/,/^SHA1:/' | 
              MYARG="$2" perl -ne '@f = split /\s+/; if ($f[3] eq $ENV{"MYARG"}) { 
    print "$f[1] $f[2]\n"; exit(0); }'
    }
    
    checkit () {
            local FILE="$1"
            local LOOKUP="$2"
    
            Y="`get_md5sumsize Release "$LOOKUP"`"
            Y="`echo "$Y" | sed 's/^ *//;s/  */ /g'`"
    
            if [ ! -e "/var/lib/apt/lists/$FILE" ]; then
                    if [ "$Y" = "" ]; then
                            # No file, but not needed anyway
                            echo "OK"
                            return
                    fi
                    echo "$FILE" &gt;&gt;MISSING
                    echo "MISSING $Y"
                    return
            fi
            if [ "$Y" = "" ]; then
                    echo "$FILE" &gt;&gt;NOCHECK
                    echo "NOCHECK"
                    return
            fi
            X="`md5sum &lt; /var/lib/apt/lists/$FILE | cut -d\  -f1` `wc -c &lt; /var/lib
    /apt/lists/$FILE`"
            X="`echo "$X" | sed 's/^ *//;s/  */ /g'`"
            if [ "$X" != "$Y" ]; then
                    echo "$FILE" >>BAD
                    echo "BAD"
                    return
            fi
            echo "$FILE" >>OK
            echo "OK"
    }
    
    echo
    echo "Checking sources in /etc/apt/sources.list:"
    echo "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"
    echo
    (echo "You should take care to ensure that the distributions you're downloading
    "
    echo "are the ones you think you are downloading, and that they are as up to"
    echo "date as you would expect (testing and unstable should be no more than"
    echo "two or three days out of date, stable-updates no more than a few weeks"
    echo "or a month)."
    ) | fmt
    echo
    
    cat /etc/apt/sources.list | 
      sed 's/^ *//' | grep '^[^#]' |
      while read ty url dist comps; do
            if [ "${url%%:*}" = "http" -o "${url%%:*}" = "ftp" ]; then
                    baseurl="${url#*://}"
            else
                    continue
            fi
    
            echo "Source: ${ty} ${url} ${dist} ${comps}"
    
            rm -f Release Release.gpg
            lynx -reload -dump "${url}/dists/${dist}/Release" >/dev/null 2&gt;&amp;1
            wget -q -O Release "${url}/dists/${dist}/Release"
    
            if ! grep -q '^' Release; then
                    echo "  * NO TOP-LEVEL Release FILE"
                    >Release
            else
                    origline=`sed -n 's/^Origin: *//p' Release | head -1`
                    lablline=`sed -n 's/^Label: *//p' Release | head -1`
                    suitline=`sed -n 's/^Suite: *//p' Release | head -1`
                    codeline=`sed -n 's/^Codename: *//p' Release | head -1`
                    dateline=`grep "^Date:" Release | head -1`
                    dscrline=`grep "^Description:" Release | head -1`
                    echo "  o Origin: $origline/$lablline"
                    echo "  o Suite: $suitline/$codeline"
                    echo "  o $dateline"
                    echo "  o $dscrline"
    
                    if [ "${dist%%/*}" != "$suitline" -a "${dist%%/*}" != "$codeline" ]; then
                            echo "  * WARNING: asked for $dist, got $suitline/$codeline"
                    fi
    
                    lynx -reload -dump "${url}/dists/${dist}/Release.gpg" &gt;/dev/null 2&gt;&amp;1
                    wget -q -O Release.gpg "${url}/dists/${dist}/Release.gpg"
    
                    gpgv --status-fd 3 Release.gpg Release 3&gt;&amp;1 >/dev/null 2&gt;&amp;1 | sed -n "s/^\[GNUPG:\] //p" | (okay=0; err=""; while read gpgcode rest; do
                            if [ "$gpgcode" = "GOODSIG" ]; then
                                if [ "$err" != "" ]; then
                                    echo "  * Signed by ${err# } key: ${rest#* }"
                                else
                                    echo "  o Signed by: ${rest#* }"
                                    okay=1
                                fi
                                err=""
                            elif [ "$gpgcode" = "BADSIG" ]; then
                                echo "  * BAD SIGNATURE BY: ${rest#* }"
                                err=""
                            elif [ "$gpgcode" = "ERRSIG" ]; then
                                echo "  * COULDN'T CHECK SIGNATURE BY KEYID: ${rest %% *}"
                                err=""
                            elif [ "$gpgcode" = "SIGREVOKED" ]; then
                                err="$err REVOKED"
                            elif [ "$gpgcode" = "SIGEXPIRED" ]; then
                                err="$err EXPIRED"
                            fi
                        done
                        if [ "$okay" != 1 ]; then
                            echo "  * NO VALID SIGNATURE"
                            &gt;Release
                        fi)
            fi
            okaycomps=""
            for comp in $comps; do
                    if [ "$ty" = "deb" ]; then
                            X=$(checkit "`echo "${baseurl}/dists/${dist}/${comp}/binary-${arch}/Release" | sed 's,//*,_,g'`" "${comp}/binary-${arch}/Release")
                            Y=$(checkit "`echo "${baseurl}/dists/${dist}/${comp}/binary-${arch}/Packages" | sed 's,//*,_,g'`" "${comp}/binary-${arch}/Packages")
                            if [ "$X $Y" = "OK OK" ]; then
                                    okaycomps="$okaycomps $comp"
                            else
                                    echo "  * PROBLEMS WITH $comp ($X, $Y)"
                            fi
                    elif [ "$ty" = "deb-src" ]; then
                            X=$(checkit "`echo "${baseurl}/dists/${dist}/${comp}/source/Release" | sed 's,//*,_,g'`" "${comp}/source/Release")
                            Y=$(checkit "`echo "${baseurl}/dists/${dist}/${comp}/source/Sources" | sed 's,//*,_,g'`" "${comp}/source/Sources")
                            if [ "$X $Y" = "OK OK" ]; then
                                    okaycomps="$okaycomps $comp"
                            else
                                    echo "  * PROBLEMS WITH component $comp ($X, $Y)"
                            fi
                    fi
            done
            [ "$okaycomps" = "" ] || echo "  o Okay:$okaycomps"
            echo
      done
    
    echo "Results"
    echo "~~~~~~~"
    echo
    
    allokay=true
    
    cd /tmp/apt-release-check
    diff &lt;(cat BAD MISSING NOCHECK OK | sort) &lt;(cd /var/lib/apt/lists &amp;&amp; find . -type f -maxdepth 1 | sed 's,^\./,,g' | grep '_' | sort) | sed -n 's/^&gt; //p' &gt;UNVALIDATED
    
    cd /tmp/apt-release-check
    if grep -q ^ UNVALIDATED; then
        allokay=false
        (echo "The following files in /var/lib/apt/lists have not been validated."
        echo "This could turn out to be a harmless indication that this script"
        echo "is buggy or out of date, or it could let trojaned packages get onto"
        echo "your system."
        ) | fmt
        echo
        sed 's/^/    /' &lt; UNVALIDATED
        echo
    fi
    
    if grep -q ^ BAD; then
        allokay=false
        (echo "The contents of the following files in /var/lib/apt/lists does not"
        echo "match what was expected. This may mean these sources are out of date,"
        echo "that the archive is having problems, or that someone is actively"
        echo "using your mirror to distribute trojans."
        if am_root; then 
            echo "The files have been renamed to have the extension .FAILED and"
            echo "will be ignored by apt."
            cat BAD | while read a; do
                mv /var/lib/apt/lists/$a /var/lib/apt/lists/${a}.FAILED
            done
        fi) | fmt
        echo
        sed 's/^/    /' &lt; BAD
        echo
    fi
    
    if grep -q ^ MISSING; then
        allokay=false
        (echo "The following files from /var/lib/apt/lists were missing. This"
        echo "may cause you to miss out on updates to some vulnerable packages."
        ) | fmt
        echo
        sed 's/^/    /' &lt; MISSING
        echo
    fi
    
    if grep -q ^ NOCHECK; then
        allokay=false
        (echo "The contents of the following files in /var/lib/apt/lists could not"
        echo "be validated due to the lack of a signed Release file, or the lack"
        echo "of an appropriate entry in a signed Release file. This probably"
        echo "means that the maintainers of these sources are slack, but may mean"
        echo "these sources are being actively used to distribute trojans."
        if am_root; then 
            echo "The files have been renamed to have the extension .FAILED and"
            echo "will be ignored by apt."
            cat NOCHECK | while read a; do
                mv /var/lib/apt/lists/$a /var/lib/apt/lists/${a}.FAILED
            done
        fi) | fmt
        echo
        sed 's/^/    /' &lt; NOCHECK
        echo
    fi
    
    if $allokay; then
        echo 'Everything seems okay!'
        echo
    fi
    
    rm -rf /tmp/apt-release-check

en: You might need to apply the following patch for <emphasis>sid</emphasis> since <command>md5sum</command> adds an '-' after the sum when the input is stdin:
pt_BR: Você pode precisar aplicar o seguinte patch para <emphasis>sid</emphasis> uma vez que <command>md5sum</command> adiciona um '-' após o sum quando a entrada é stdin:

en: 
    @@ -37,7 +37,7 @@
            local LOOKUP="$2"
    
            Y="`get_md5sumsize Release "$LOOKUP"`"
    -       Y="`echo "$Y" | sed 's/^ *//;s/  */ /g'`"
    +       Y="`echo "$Y" | sed 's/-//;s/^ *//;s/  */ /g'`"
    
            if [ ! -e "/var/lib/apt/lists/$FILE" ]; then
                    if [ "$Y" = "" ]; then
    @@ -55,7 +55,7 @@
                    return
            fi
            X="`md5sum &lt; /var/lib/apt/lists/$FILE` `wc -c &lt; /var/lib/apt/lists/$FILE`"
    -       X="`echo "$X" | sed 's/^ *//;s/  */ /g'`"
    +       X="`echo "$X" | sed 's/-//;s/^ *//;s/  */ /g'`"
            if [ "$X" != "$Y" ]; then
                    echo "$FILE" &gt;&gt;BAD
                    echo "BAD"
pt_BR: 
    @@ -37,7 +37,7 @@
            local LOOKUP="$2"
    
            Y="`get_md5sumsize Release "$LOOKUP"`"
    -       Y="`echo "$Y" | sed 's/^ *//;s/  */ /g'`"
    +       Y="`echo "$Y" | sed 's/-//;s/^ *//;s/  */ /g'`"
    
            if [ ! -e "/var/lib/apt/lists/$FILE" ]; then
                    if [ "$Y" = "" ]; then
    @@ -55,7 +55,7 @@
                    return
            fi
            X="`md5sum &lt; /var/lib/apt/lists/$FILE` `wc -c &lt; /var/lib/apt/lists/$FILE`"
    -       X="`echo "$X" | sed 's/^ *//;s/  */ /g'`"
    +       X="`echo "$X" | sed 's/-//;s/^ *//;s/  */ /g'`"
            if [ "$X" != "$Y" ]; then
                    echo "$FILE" >>BAD
                    echo "BAD"

en: Alternative per-package signing scheme
pt_BR: Esquema alternativo de assinatura per-package

en: The additional scheme of signing each and every packages allows packages to be checked when they are no longer referenced by an existing <filename>Packages</filename> file, and also third-party packages where no <filename>Packages</filename> ever existed for them can be also used in Debian but will not be default scheme.
pt_BR: The additional scheme of signing each and every packages allows packages to be checked when they are no longer referenced by an existing Packages file, and also third-party packages where no Packages ever existed for them can be also used in Debian but will not be default scheme.

en: NOTE: Currently <filename>/etc/dpkg/dpkg.cfg</filename> ships with "no-debsig" as per default.
pt_BR: NOTA: Atualmente <filename>/etc/dpkg/dpkg.cfg</filename> trabalha com "no-debsig" como padrão.

en: NOTE2: Signatures from developers are currently stripped when they enter off the package archive since the currently preferred method is release checks as described previously.
pt_BR: NOTA 2: Signatures from developers are currently stripped when they enter off the package archive since the currently preferred method is release checks as described previously.
