2004-04-05 13:33:18

by Xan

[permalink] [raw]
Subject: [kernel.org] md5 for verifying downloads of kernel [right post]

Is it possible to put in webpage and in ftp a link and a file, respectively,
of the md5 sums (or any other checking file program) of all kernel files?.
With this, anyone could see if the downloaded kernel file (usually more than
30MB) is well-downloaded.

Thanks,
Xan.

PS: I believe that one good place to put link were after cset link. That is,
the lines of kernel.org were as:

[...]???2.6.4 ??2004-03-11 03:16
UTC ???F ??????V ??????VI ?????C ??????MD5?????Changelog


2004-04-05 16:07:20

by H. Peter Anvin

[permalink] [raw]
Subject: Re: [kernel.org] md5 for verifying downloads of kernel [right post]

Xan wrote:
> Is it possible to put in webpage and in ftp a link and a file, respectively,
> of the md5 sums (or any other checking file program) of all kernel files?.
> With this, anyone could see if the downloaded kernel file (usually more than
> 30MB) is well-downloaded.
>
> Thanks,
> Xan.
>
> PS: I believe that one good place to put link were after cset link. That is,
> the lines of kernel.org were as:
>
> [...] 2.6.4 2004-03-11 03:16
> UTC F V VI C MD5 Changelog
>

Look for .sign files.

-hpa

2004-04-06 08:26:14

by Xan

[permalink] [raw]
Subject: Re: [kernel.org] md5 for verifying downloads of kernel [right post]

Dimarts 06 Abril 2004 03:52, en/na Mark Hahn (<Mark Hahn
<[email protected]>>) va escriure:
> > Is it possible to put in webpage and in ftp a link and a file,
> > respectively, of the md5 sums (or any other checking file program) of all
> > kernel files?.
>
> why are you not satisfied with the current GnuPG signatures on
> kernel tars and patch files?
>
> ie
> ftp://ftp.kernel.org/pub/linux/kernel/v2.6/linux-2.6.1.tar.gz.sign
>
> > With this, anyone could see if the downloaded kernel file (usually more
> > than 30MB) is well-downloaded.
>
> indeed, tars and patches have been signed for a long time.

Okay. I did not know that. Now I satisfied ;-). But, I think a "miss": the
webmaster of kernel.org could link the signature of all kernel files (?).
That is, could we have got something like:

The latest stable version of the Linux kernel is: 2.6.5 2004-04-04 04:17
UTC F V VI C Changelog SIGN

where SIGN links to 2.6.5 signature?

Sorry, but I think that the reference to signature page in kernel.org is not
of all visible. It's in a more low possition, I think.

Sorry for ask that,
Xan.