Content-Type: text/plain;
	charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3776.700.51.11.1\))
Subject: Re: Hash Value for Updated POSTGRESQL?
From: Daniel Gustafsson <daniel@yesql.se>
In-Reply-To: 
 <PH8PR09MB9833528FB0652B092226E53C93FE2@PH8PR09MB9833.namprd09.prod.outlook.com>
Date: Tue, 18 Feb 2025 12:49:21 +0100
Cc: "pgsql-odbc@postgresql.org" <pgsql-odbc@postgresql.org>,
 "LeMaster, James C" <LeMasterJC@gru.com>,
 "Gause Jr, George" <GauseG1@gru.com>
Content-Transfer-Encoding: quoted-printable
Message-Id: <2D4A1EED-E6AD-4AD9-BDD2-CCA07847CF68@yesql.se>
References: 
 <PH8PR09MB9833528FB0652B092226E53C93FE2@PH8PR09MB9833.namprd09.prod.outlook.com>
To: "Moore, David A" <MOOREDA9@gru.com>
Archived-At: 
 <https://www.postgresql.org/message-id/2D4A1EED-E6AD-4AD9-BDD2-CCA07847CF68%40yesql.se>
Precedence: bulk

> On 14 Feb 2025, at 20:33, Moore, David A <MOOREDA9@gru.com> wrote:
>=20
> Hello,  We are a NERC regulated organization in the critical =
infrastructure arena. The most recent zero-day injection bug =
(CVE-2025-1094) has us concerned. We are attempting to update our =
postgresql, which has several dependencies in our organization. We are =
failing to find a md5 to verify authenticity and perform an integrity =
check on the installation file. I have researched this and finding =
nothing on this topic except for other orgs finding the same issues. Can =
you please advise us on this and any method of verification that you may =
provide that will satisfy our stringent compliance requirements?

First of all, you are emailing the discussion list for the postgres ODBC =
driver
but reading your email I'm fairly sure you mean the postgres server and =
not the
ODBC driver.

Regarding package signatures, the postgres project only offers source =
core
downloads and for those hash fingerprints are available.  See for =
example the
17.3 version:

	https://www.postgresql.org/ftp/source/v17.3/

If you download a pre-built package or installer you need to check with =
whom it
is you are downloading from.

--
Daniel Gustafsson