DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:message-id:date:from:mime-version:to:cc
	:subject:content-type:content-transfer-encoding; q=dns; s=
	default; b=DmIlvUGieJ0IvhDEZIDy5DIS2lKJa7s0JdUsYF1MghfS+B0Zad7kr
	YlBNAohHjxqwrRut/hTJqAUJqxPpeZB4M8lGvw3lw0h60ZhjKhr+XkoXhnh3bBvq
	dmb1nzEzFmNnMd/cgNOQoAwc4g9gLx3yx5324mhIsxnJ05oDX0OLaY=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
Message-ID: <53BA242D.1040101@cisra.canon.com.au>
Date: Mon, 7 Jul 2014 14:38:05 +1000
From: Luke Kendall <luke.kendall@cisra.canon.com.au>
User-Agent: Mozilla/5.0 (X11; Linux i686 on x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.5.0
MIME-Version: 1.0
To: "cygwin@cygwin.com" <cygwin@cygwin.com>
CC: audit <audit-mail-disclaimer@cisra.canon.com.au>
Subject: Observations about Cygwin's md5 checksums
Content-Type: text/plain; charset="ISO-8859-1"; format=flowed
Content-Transfer-Encoding: 7bit

Here are five observations about md5 checksums in Cygwin.  I share it in 
case it may be of some small interest to a few people.  Please note that 
I may be wrong; if so, I'm happy to be corrected.

1) For each package, Cygwin stores the md5sum for the components of the 
main parts of the package in the setup.ini file.  The exception is the 
setup.hint file: its md5 sum is not recorded in setup.ini.

2) In each zip file for each package, an md5.sum file is almost always 
provided.  But not always. (*)

3) These md5.sum files list all the components of the package (including 
setup.hint), but these md5 sums are not reliable: they often don't match 
the actual md5 checksum (of the file itself, or of course the md5 stored 
for it in setup.ini).(**)

4) The most common file to have the wrong md5 checksum is setup.hint

5) It's not rare for files to be mentioned in a package's md5.sum which 
are be absent from the package itself.(***)

I'm curious about the purpose of having the md5.sum file in each 
package.  Is it a relic of a previous system?

The above observations are based on a few weeks of mirroring and 
automatically checking the md5 sums of what we downloaded.  The main 
site we used was aarnet.edu.au (IIRC); recently we changed to 
mirrors.kernel.org, but from my ad hoc checks there wasn't much 
difference between the two).

Regards,

luke

(*)
For mirrors.kernel.org last night:

Worrying: X11/khronos-opengl-registry has no md5.sum file
Worrying: X11/xlaunch has no md5.sum file
Worrying: cygwin64-gcc/cygwin64-gcc-debuginfo has no md5.sum file
Worrying: git/git-oodiff has no md5.sum file
Worrying: git/stgit has no md5.sum file
Worrying: git/tig has no md5.sum file
Worrying: man has no md5.sum file
Worrying: python/python-paramiko has no md5.sum file

(**)
$ grep FAILED [path-omitted]/x86/cygwin-archive-incomplete.txt | wc
      55     110    1463
$ grep "^setup.hint: FAILED" 
[path-omitted]/x86/cygwin-archive-incomplete.txt | wc
      28      56     560

(***)
$ wc -l < [path-omitted]/x86/cygwin-archive-all-missing-files.txt
406


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple