sha256sum Fedora-14-Beta-i386-DVD.is

[Terry Polzin]

sha256sum Fedora-14-Beta-i386-DVD.iso 
8cf311230f8898c2eb7c53e4c4dfa69c17e44c4b735eaeff0cb4883b9ef16ece
Fedora-14-Beta-i386-DVD.iso

I can't locate the published sum.  Is this correct?

[JD]

On 09/29/2010 11:54 AM, Terry Polzin wrote:
> sha256sum Fedora-14-Beta-i386-DVD.iso
> 8cf311230f8898c2eb7c53e4c4dfa69c17e44c4b735eaeff0cb4883b9ef16ece
> Fedora-14-Beta-i386-DVD.iso
>
> I can't locate the published sum.  Is this correct?

See
http://mirrors.kernel.org/fedora/releases/test/14-Beta/Fedora/i386/iso/Fedor...

[Tom Horsley]

On Wed, 29 Sep 2010 12:07:19 -0700
JD wrote:
> > I can't locate the published sum.  Is this correct?
>
> See
> http://mirrors.kernel.org/fedora/releases/test/14-Beta/Fedora/i386/iso/Fedor...

Yea, it kinda bugs me that the -CHECKSUM file is not included
in the torrent and isn't very easy to find. I've been copying the
link pointing to the direct DVD download, stripping off the filename
on the end, and visiting just the directory to find the checksum
file, but that seems kinda klunky to me.

[JD]

On 09/29/2010 12:14 PM, Tom Horsley wrote:
> On Wed, 29 Sep 2010 12:07:19 -0700
> JD wrote:
> > > I can't locate the published sum.  Is this correct?
> >
> > See
> > http://mirrors.kernel.org/fedora/releases/test/14-Beta/Fedora/i386/iso/Fedor...
>
> Yea, it kinda bugs me that the -CHECKSUM file is not included
> in the torrent and isn't very easy to find. I've been copying the
> link pointing to the direct DVD download, stripping off the filename
> on the end, and visiting just the directory to find the checksum
> file, but that seems kinda klunky to me.

Why not always resort to

http://mirrors.kernel.org/fedora/releases
or
http://mirrors.kernel.org/fedora/updates
???????

If you went to some torrent site, you could be
risking rooting your system with a trojan or a
backdoor.

[Andre Robatino]

Tom Horsley <horsley1953 <at> gmail.com> writes:
> Yea, it kinda bugs me that the -CHECKSUM file is not included
> in the torrent and isn't very easy to find. I've been copying the
> link pointing to the direct DVD download, stripping off the filename
> on the end, and visiting just the directory to find the checksum
> file, but that seems kinda klunky to me.

Looking at the 14 Alpha and Beta torrents, it looks like the install torrents
have no checksum file at all, while the Live torrents only have an unsigned
checksum file (which is useless in a torrent).

[Tom Horsley]

On Wed, 29 Sep 2010 12:33:41 -0700
JD wrote:
> If you went to some torrent site, you could be
> risking rooting your system with a trojan or a
> backdoor.

I don't go to "some torrent site", I click on the
torrent link on the fedora download page, but there doesn't
appear to be a convenient link in the same vicinity
to download the checksum file.

[Andre Robatino]

Andre Robatino <robatino <at> fedoraproject.org> writes:
> Looking at the 14 Alpha and Beta torrents, it looks like the install torrents
> have no checksum file at all, while the Live torrents only have an unsigned
> checksum file (which is useless in a torrent).

Looks like there was no bug report, filed one:

https://bugzilla.redhat.com/show_bug.cgi?id=638738

[Andre Robatino]

JD <jd1008 <at> gmail.com> writes:
> If you went to some torrent site, you could be
> risking rooting your system with a trojan or a
> backdoor.

If a signed checksum file is available, and its signature is verified, and the
ISO's checksum matches the checksum file, it doesn't matter where the ISO came
from. On the other hand, even a "trusted" site can be hacked.

[JD]

On 09/29/2010 12:46 PM, Tom Horsley wrote:
> On Wed, 29 Sep 2010 12:33:41 -0700
> JD wrote:
> > If you went to some torrent site, you could be
> > risking rooting your system with a trojan or a
> > backdoor.
>
> I don't go to "some torrent site", I click on the
> torrent link on the fedora download page, but there doesn't
> appear to be a convenient link in the same vicinity
> to download the checksum file.

That's good :)

[JD]

On 09/29/2010 12:53 PM, Andre Robatino wrote:
> JD<jd1008<at>  gmail.com>  writes:
> > If you went to some torrent site, you could be
> > risking rooting your system with a trojan or a
> > backdoor.
>
> If a signed checksum file is available, and its signature is verified, and the
> ISO's checksum matches the checksum file, it doesn't matter where the ISO came
> from. On the other hand, even a "trusted" site can be hacked.

True, but the OP could not find the checksum there.

[Terry Polzin]

On Wed, 2010-09-29 at 12:07 -0700, JD wrote:
> On 09/29/2010 11:54 AM, Terry Polzin wrote:
> > sha256sum Fedora-14-Beta-i386-DVD.iso
> > 8cf311230f8898c2eb7c53e4c4dfa69c17e44c4b735eaeff0cb4883b9ef16ece
> > Fedora-14-Beta-i386-DVD.iso
> >
> > I can't locate the published sum.  Is this correct?
>
> See
> http://mirrors.kernel.org/fedora/releases/test/14-Beta/Fedora/i386/iso/Fedor...

Thanks for the link JD. the fedora project page points to the F13
checksums file. You just never know what mirrors are going to host a
BETA and the link on the beta download page should point to the correct
file.

[JD]

On 09/29/2010 01:37 PM, Terry Polzin wrote:
> On Wed, 2010-09-29 at 12:07 -0700, JD wrote:
> > On 09/29/2010 11:54 AM, Terry Polzin wrote:
> > > sha256sum Fedora-14-Beta-i386-DVD.iso
> > > 8cf311230f8898c2eb7c53e4c4dfa69c17e44c4b735eaeff0cb4883b9ef16ece
> > > Fedora-14-Beta-i386-DVD.iso
> > >
> > > I can't locate the published sum.  Is this correct?
> >
> > See
> > http://mirrors.kernel.org/fedora/releases/test/14-Beta/Fedora/i386/iso/Fedor...
>
> Thanks for the link JD. the fedora project page points to the F13
> checksums file.

You're welcome.
> You just never know what mirrors are going to host a
> BETA and the link on the beta download page should point to the correct
> file.

What do you mean? That the Kernel.Org mirror would post
wrong links?
I have never seen that myself.