Re: Hashsum mismatch prevention strategies

[Goswin von Brederlow <goswin-v-b@web.de>]

David Kalnischkies <kalnischkies+debian@gmail.com> writes:

> The alternative to tell the methods the expected values (hashes, size, ?)
> might be nicer. Especially http code could use the size (if known) to
> compare with Content-Length (if send by server) to know before the
> download is completed if the data we got belongs to the file we requested.
> (size mismatches very likely produce hashsum mismatches, too)
>
> [Noted both as an idea to test for the next abi break]

Yes please. That would allow writing a http method with fallback. For
example if the http method gets multiple IPs for a host then it could
try them all until it finds a server with the correct hash.

It would also allow implementing a method for a hash.d.o service I
suggested for fetching index files that are broken on a mirror without
having to teach apt how to encode the hash.

MfG
        Goswin