Re: Does Debian use implemented MD5 sums ?

["Thomas Schmitt" <scdbackup@gmx.net>]

Hi,

Alexey Eromenko wrote:
> implantisomd5 [...]
> Basically it implants the MD5sum into a secret portion of ISO 9660
> filesystem

Not so secret. At least if it stems from
  https://github.com/rhinstaller/isomd5sum/blob/master/libimplantisomd5.c

The MD5 gets written into a field of the ISO 9660 Primary Volume Descriptor
which begins at byte offset 32768. From there 883 bytes up, ECMA-119
specifies:

 8.4.32  Application Use (BP 884 to 1395)
         This field shall be reserved for application use.
         Its content is not specified by this Standard.

(BP counting starts at 1)

I understand that implantisomd5 divides the ISO in 20 "fragments" of
which it computes separate checksum. From those it takes three bytes
each and converts them to 120 hex digits. Then it prints the overall
MD5, some other info, and the 120 digit "fragment md5sums string"
into the Application Use field.
This all has to fit into 512 bytes. I wonder why it wastes lots of
them by a hex representation.


> Does Debian has something similar ?

It could easily have:

  xorriso -as mkisofs ... --md5 ...

This records an MD5 for the extended superblock (System Area, PVD,
El Torito Boot Record, Joliet Supplementary Volume Descriptor),
plus one for the image up to the end of the directory tree,
plus one for the overall ISO image.
Additionally it records an MD5 for each data file in the ISO.

These MD5 get stored as compact array at the very end of the ISO.
Thus they can be produced as stream without the need for revisiting
the ISO image after production.

They can be checked on any random access storage medium by commands
like

  xorriso -md5 on -indev stdio:/dev/sdc -check_media --

which checks the three image checksums, or

  xorriso -md5 on -indev /dev/sr0 -check_md5_r sorry / --

which checks the individual MD5s of the data files in the image.


Have a nice day :)

Thomas