On 20/07/2025 17:54, Alexey Eromenko wrote:
One thing that I consider very useful -- is the addition of MD5sum into the ISO image itself.
I think the feature is already present, but not easily visible.
Thankfully Debian already has the tools to do this: "implantisomd5 mydata.iso" and "checkisomd5 -v mydata.iso"
When using the netinst image, you can verify the files from the installer: at the first (language selection) screen, press `Esc` and then select `Check the integrity of installation media` from the main menu.
The live images additionally have a GRUB menu entry: `Utilities...` and then `Verify integrity of the boot medium`.
This is very handy to check multiple ISOs quickly without resorting to an external file like "isos.md5", especially when I copy the ISOs from one Hard Disk to the next, and may forget the accompanying .md5 file.
Several months ago, I've asked this list whether is would be meaningful to have sha256 checksums instead of md5 checksums. The short answer:
If you want to verify the ISO files themselves, without booting them, you can use the SHA256SUM or SHA512SUM files that are provided from the download location (and those files are signed, for extra confirmation).
It is not advisable to boot the ISO files if this checksum does not match. The md5 checksums in the image itself are just extra validation, so a md5 is sufficient.
With kind regards, Roland Clobus
Attachment:
OpenPGP_signature.asc
Description: OpenPGP digital signature