Re: md5sum for weekly images ?

[Mattias Wadenstein <maswan@acc.umu.se>]

On Tue, 25 Jan 2005, Justin Pryzby wrote:

> Hello masters of ftp.acc.umu.se, one of the users of the CD images
> available from your file server [0] has inquired about the
> availability of MD5 checksum files for the weekly unofficial Sarge
> image.  Are these files available from your host (or elsewhere)?
>
> [0] http://ftp.acc.umu.se/pub/cd-images/debian/

It is a known bug that they are not propagated to the tree with isos. But 
they are available together with the jigdos:

http://cdimage.debian.org/pub/cdimage-testing/cd/jigdo-area/

/Mattias Wadenstein

> Thanks,
> Justin
>
> <<<<<<<
> Its quite possible that they're not generated, or not stored
> publically.  I'm copying the ftpmasters of that site to inquire.
>
> I might also add that md5sums are only marginally useful unless
> they're cryptographically signed.  TCP transport already uses a
> checksum, and if you successfully download a working 700MB image, then
> you can be moderately confident that it transferred successfully.
> With a gpg signature, you additionally have the metaphorical "word" of
> the signer: "This is a valid file and it has not been modified by
> anyone I don't trust, since it is stored on my own host ...".  Such a
> signature prevents, for example, a trojan copy of the ISO from being
> stored on an alternate site, or DNS spoofing to "fake" the host from
> which you retrieve the file.
>
> On Tue, Jan 25, 2005 at 08:53:04AM +0100, xerces8 wrote:
> > Hi!
> >
> > I can't find the MD5SUM list for the files at
> > http://ftp.acc.umu.se/pub/cd-images/debian-weekly/i386/
> >
> > Can anyone help ?