Re: bug 887830, was: Joliet name length in amd64 netinst versus DVD-2

2018-02-16 Thread Steve McIntyre 
On Mon, Feb 12, 2018 at 05:29:45PM +0100, Thomas Schmitt wrote:
>
>Now the next weakest point in Jigdo download is 
>
>  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=887831
>  "jigdo-file: Jigdo .template file and resulting ISO are only verified by MD5"
>
>jigdo-lite after fix of bug 865864 downloads the .template if it yet
>missing in the local directory. Verification is done by line
>"Template-MD5Sum" of the .jigdo file, not by *SUMS.
>
>jigdo-lite could now make automatic use of the *SUMS via the according
>*sum programs.

That's a change I don't really want to make - the *SUMS we have are
specific to the Debian layout, and AFAIK we're not the only people
using jigdo.

>Or jigdo-lite could expect better .template checksums in the .jigdo file
>and jigdo-file could learn to compute such sums.
>libjte can, so jigdo-file could learn from there.

That makes much more sense, yes. As/when/if I find the time, I'll
fight with the C++ in jigdo-file to look for better checksums.

-- 
Steve McIntyre, Cambridge, UK.st...@einval.com
  Getting a SCSI chain working is perfectly simple if you remember that there
  must be exactly three terminations: one on one end of the cable, one on the
  far end, and the goat, terminated over the SCSI chain with a silver-handled
  knife whilst burning *black* candles. --- Anthony DeBoer

Re: bug 887830, was: Joliet name length in amd64 netinst versus DVD-2

2018-02-12 Thread Thomas Schmitt 
Hi,

i wrote:
> >  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=887830
> >  "debian-cd: *.jigdo files should be listed in the *SUMS files"

Steve McIntyre:
> ACK, it's a fairly simple fix to the debian-cd setup. I've pushed the
> changes and if you check today's daily/weekly builds you'll see that
> the jigdo and template files are listed in the checksums files too!

That's good news. Especially for users of old jigdo-lite who download
the .template files manually because of the old "https" inability
(see fixed bug 865864).

I tested with
  
https://cdimage.debian.org/mirror/cdimage/weekly-builds/amd64/jigdo-cd/debian-testing-amd64-netinst.{jigdo,template}
MD5, SHA256, and SHA512 match nicely.

-

Now the next weakest point in Jigdo download is 

  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=887831
  "jigdo-file: Jigdo .template file and resulting ISO are only verified by MD5"

jigdo-lite after fix of bug 865864 downloads the .template if it yet
missing in the local directory. Verification is done by line
"Template-MD5Sum" of the .jigdo file, not by *SUMS.

jigdo-lite could now make automatic use of the *SUMS via the according
*sum programs.

Or jigdo-lite could expect better .template checksums in the .jigdo file
and jigdo-file could learn to compute such sums.
libjte can, so jigdo-file could learn from there.


Have a nice day :)

Thomas