[Julien Cristau] > > fundamentally, shipping a md5sums file is really just a tradeoff in > > download size vs. installation speed, not unlike gzip vs. bzip2. One > > Only if you assume that disks never fail and thus files never get > corrupted when the package gets unpacked.
Given a .deb, turning the data.tar.gz into foo.md5sums is a SMOP. This could be before, during, or after the deb is unpacked. Using the packaged foo.md5sums as an internal consistency check of data.tar.gz itself is interesting, but somewhat unwieldy. Better would be to checksum data.tar.gz in its entirety. But doesn't gzip already do that? (Yes, it's only 32 bits, but we aren't trying to detect intentional tampering, only corruption. To detect intentional tampering, you need signed debs, or at least signed Packages.bz2.) -- Peter Samuelson | org-tld!p12n!peter | http://p12n.org/ -- To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org Archive: http://lists.debian.org/20100303200201.gg18...@p12n.org
