On 04/11/15 13:28, Steve Dougherty wrote: > On 10/27/2015 09:53 AM, bob.tro...@pirateparty.ca wrote: >> I would like to investigate using freenet or a variant hacked by me to >> keep some of my Pirate Party communications at least nominally secure. >> >> I downloaded a binary installation file from the site, but was unable to >> find an MD5 hash associated with it. File listing (in Windows) is as >> following: >> >> 10/26/2015 11:18 PM 18,053,944 FreenetInstaller-1470.exe >> >> The MD5 hash is d47b1494564e98a5d772477fb8967828 as calculated by my own >> MD5 utility and checked by onlinemd5.com >> (D47B1494564E98A5D772477FB8967828). >> >> I found a hash for a file with the same name on another site, but that >> hash differs from the one from my file. Is that the correct md5 hash for >> that file? > The correct hash for the updated installer is the one you observed - > d47b1494564e98a5d772477fb8967828. The Windows installer was updated on > October 25th to include new translations. [0] The correct hash for the > initial release of the installer is 7053ba4bbf0ae9f833406ae43d1d1422. > >> Do you have some other way of validating a file or is perhaps the >> typical way of getting the files on freenet itself? > There are GPG signatures, but they aren't yet visible alongside the > download links. Your question has prompted me to realize that the > signature for the updated installer wasn't published, so I'll need to > make changes to the Windows installer release scripts. For now I'll > attach it. > > The initial release of the build 1470 installer and its signature can be > found here: > > https://downloads.freenetproject.org/alpha/installer/ > https://downloads.freenetproject.org/alpha/installer/FreenetInstaller-1470.exe > https://downloads.freenetproject.org/alpha/installer/FreenetInstaller-1470.exe.sig > > To get the installer through Freenet see the "You can find the latest > Windows installer" part on the Friends > Add a Friend page. > > - Steve > > [0] https://freenetproject.org/news.html#20151025 Also, you really shouldn't rely on MD5 for anything important. It's known to be broken, and there are fairly advanced attacks now IIRC. SHA256 is reasonable, and is widely used in Freenet, although there are some known issues. Whether we should trust Keccak is a debatable point!
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Support mailing list Support@freenetproject.org http://news.gmane.org/gmane.network.freenet.support Unsubscribe at http://emu.freenetproject.org/cgi-bin/mailman/listinfo/support Or mailto:support-requ...@freenetproject.org?subject=unsubscribe