Re: md5sums files

[Peter Samuelson <peter@p12n.org>]

[Julien Cristau]
> > fundamentally, shipping a md5sums file is really just a tradeoff in
> > download size vs. installation speed, not unlike gzip vs. bzip2.  One
> 
> Only if you assume that disks never fail and thus files never get
> corrupted when the package gets unpacked.

Given a .deb, turning the data.tar.gz into foo.md5sums is a SMOP.
This could be before, during, or after the deb is unpacked.

Using the packaged foo.md5sums as an internal consistency check of
data.tar.gz itself is interesting, but somewhat unwieldy.  Better would
be to checksum data.tar.gz in its entirety.  But doesn't gzip already
do that?  (Yes, it's only 32 bits, but we aren't trying to detect
intentional tampering, only corruption.  To detect intentional
tampering, you need signed debs, or at least signed Packages.bz2.)
-- 
Peter Samuelson | org-tld!p12n!peter | http://p12n.org/