X-Spam-Check-By: sourceware.org
Message-ID: <4644CB03.9070707@determina.com>
Date: Fri, 11 May 2007 12:58:59 -0700
From: Alexander Sotirov <asotirov AT determina DOT com>
User-Agent: Thunderbird 1.5.0.10 (Windows/20070221)
MIME-Version: 1.0
To: cygwin AT cygwin DOT com
Subject: Re: MD5s of setup.exe on mirrors.
References: <5qd5179mvu DOT fsf AT hod DOT lan DOT m-e-leypold DOT de>
In-Reply-To: <5qd5179mvu.fsf@hod.lan.m-e-leypold.de>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-IsSubscribed: yes
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id: <cygwin.cygwin.com>
List-Subscribe: <mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive: <http://sourceware.org/ml/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
Delivered-To: mailing list cygwin AT cygwin DOT com

ls-cygwin-2006 AT m-e-leypold DOT de wrote:
> Cygwin mirrors have in their toplevel a setup.exe and an md5.sum. The
> m5sum is
> 
>   ae1944f528338033bab3b4710d5bd736  setup.bz2
>   b31ddcef84f25919a5d3184167b4a90d  setup.exe
>   0503889504b7ff0b23e65586a522b3ad  setup.ini
> 
> whereas the setup.exe has actually the md5sum:
> 
>   fbc848393ed05ef4f51a253f75bcafeb
> 
> I checked that for ftp://mirror.switch.ch/mirror/cygwin/setup.exe and
> ftp://ftp.mirror.ac.uk/sites/sources.redhat.com/ftp/cygwin/setup.exe
> and some others.

I reported this in January: http://cygwin.com/ml/cygwin/2007-02/msg00006.html

Nobody seemed to care. Considering the fact that MD5 collisions are now trivial
to generate, it probably doesn't matter much anyways - the fact that your copy
of setup.exe has the right MD5 doesn't mean that it hasn't been tampered with.

Alex

--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/