help on suspicious rpm

[mariowizard]

Hello there being myself totally paranoid and a little mind obfuscated this morning I ran this command

sudo rpm -hiv

on this package (totally wrong package)

ftp: //fr2.rpmfind.net/linux/sourceforge/v/project/vl/vlc/0.8.5/fedora/4/i386/vlc/0.8.5/vlc-source/ffmpeg-svn_5999-1.src.rpm

(please join ftp: and the rest of the address)

That came out with strange messages such as "user jpsaman does not exist, using root user"

I am rather worried since I suspect I might have installed something that would harm my security.

I tried to look inside the package but being not expert at all I can't be sure it is something innocent and simply not working or whether it is something harmful.

Can I please be helped by someone with better skills than mine? Thank you

[Rubberman]

So, are you trying to get the source code to ffmpeg? Why not get it directly from the ffmpeg repository? If you have git installed, then do this:

git clone git://git.videolan.org/ffmpeg.git ffmpeg

Here is a link to their download page: Get FFmpeg

[Irithori]

That warning has an explanation and is nothing to worry about.

The packager created that rpm with the userid "jpsaman".
Without any precautions, this userid is recorded for the files/dirs/links/etc in that src.rpm.

While installing on your system, jpsaman was not available (naturally).
So the rpm logic used a fallback userid, and that fallback userid is root.

No problem here

[Irithori]

That said, is there a reason to use this ancient version?
- Fedora 4,
- vlc 0.8.5
- and ffmpeg svn revision 5999?
The last one before they switched to git:

The last revision committed to SVN was r26402 on 2011-01-19.

I can´t think of a reason, except archeologic interest


@Rubberman:
There might be a benefit in using src.rpms instead of sources.
If you need just a few tweeks, then a new rpm package is just a rpmbuild away.

And at least on my part, I am a big fan of packages.
My developers can do whatever they want in their homes.
But if they want something installed systemwide, then it needs to be packaged.
ymmv

[mariowizard]

That said, is there a reason to use this ancient version?
- Fedora 4,
- vlc 0.8.5
- and ffmpeg svn revision 5999?
The last one before they switched to git:


I can´t think of a reason, except archeologic interest


@Rubberman:
There might be a benefit in using src.rpms instead of sources.
If you need just a few tweeks, then a new rpm package is just a rpmbuild away.

And at least on my part, I am a big fan of packages.
My developers can do whatever they want in their homes.
But if they want something installed systemwide, then it needs to be packaged.
ymmv

The only reason for it was my being absolutely mind obfuscated that (hopefully) very day.

Thanks a lot for you answers!