1

Why are the modification dates set to when files were modified by developers and not when they were modified in Debian?

I'm using Debian 9.1 with KDE and with the help of tripwire I noticed some files with the Modify Time set to a time when I wasn't even home and had my encrypted computer shut off completely. Hence I guess that these modification dates are not the dates when the files were modified on my computer but when they were modified by the developers.

Why is that? Why aren't the modification dates set to the date when the update was done? Isn't that the date they were modified on the local machine? If I got something wrong (e.g. that not being the modification-date of developers) I'll edit my question.

The files are:

/lib/systemd/system/tor.service
/lib/systemd/system/[email protected]
/lib/systemd/system/[email protected]
/lib/systemd/system-generators/tor-generator
/usr/sbin/tor
/usr/sbin/tor-instance-create
cas
  • 1
  • 7
  • 119
  • 185
mYnDstrEAm
  • 4,008
  • 13
  • 49
  • 108
  • Did you modify that files by yourself? Installing software is just copying files with their attributes, that includes modification date. – Pablo Recalde Aug 17 '17 at 22:05
  • I updated them via apper via the tor repository. But on another date. But why doesn't updating software change the modification date? And isn't there a separate creation date anyway? – mYnDstrEAm Aug 17 '17 at 22:08
  • You can use `stat` to see the Access, Modify, and Change dates, although they may not provide any benefit. `stat ` – jesse_b Aug 17 '17 at 22:08
  • Updating means extracting and replacing files, I think the problem is that your concept of modifying a file is not the same as Debian is. – Pablo Recalde Aug 17 '17 at 22:10

1 Answers1

4

Usually, an archived file (as in tar) keeps its modification time once extracted on disk. Use ls -lc to know when it was actually saved on disk by the Debian packaging system.

xhienne
  • 17,075
  • 2
  • 52
  • 68
  • Does the same go for packages updated via Apper or the Debian's Software Center? And wouldn't that be the creation-time? While your answer is very useful it doesn't really answer the _Why_ part of my question (also consider the problems this causes; such as for tripwire scans). – mYnDstrEAm Aug 18 '17 at 09:48
  • 1
    @mYnDstrEAm 1. I don't know either of Apper and Software Center but whatever the repository, what matters is the package and a .deb package is an archive such as the one I'm talking about. 2. No, ctime is "change time" 3. tripwire should not rely on mtime but on ctime. If a file can be modified by an intruder, they can set the mtime of the file to anything they want, contrary to ctime. As for the why, I don't know and I don't even know if it's intentional. The mtime doesn't matter much, the ctime does. – xhienne Aug 18 '17 at 10:06