Hi Charles,<br><br><div class="gmail_quote">2011/2/18 Charles Lepple <span dir="ltr"><<a href="mailto:clepple@gmail.com">clepple@gmail.com</a>></span><br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div style="word-wrap: break-word;"><div class="im"><div><div>On Feb 17, 2011, at 8:41 AM, Arnaud Quette wrote:</div><br><blockquote type="cite">Hi John,<br><br><div class="gmail_quote">2011/1/17 John Bayly<br><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<div>On 14/01/2011 20:40, Arnaud Quette wrote:<br> </div><blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;"><div> Author: aquette<br> Date: Fri Jan 14 20:40:06 2011<br>
New Revision: 2832<br> URL: <a href="http://trac.networkupstools.org/projects/nut/changeset/2832" target="_blank">http://trac.networkupstools.org/projects/nut/changeset/2832</a><br> <br></div><div> +link:<a href="http://www.networkupstools.org/source/2.6/nut-2.6.0.tar.gz.sig%5Bsignature%5D" target="_blank">http://www.networkupstools.org/source/2.6/nut-2.6.0.tar.gz.sig[signature]</a><br>
</div></blockquote> May I suggest that you also provide checksums for the tarball? I'm updating the FreeBSD port, and wanted to verify the SHA256 sum. As it's been downloaded from the NUT website, I know the odds of the source being tainted are astronomical, but if it's for a distribution, I thought I'd be extra cautious.<br>
As it is I've verified the GPG sig (never used it before) and used the computed SHA sum.<br></blockquote></div><br>I've added a SHA256 hash, and referenced it in the download section:<br><a href="http://www.networkupstools.org/download.html" target="_blank">http://www.networkupstools.org/download.html</a><br>
<br>I've not yet updated the documentation, but it's simple as downloading the nut archive and the matching .sha256 file. Then using:<br>$ sha256sum -c nut-2.6.0.tar.gz.sha256<br clear="all"></blockquote></div><br>
</div><div>Arnaud,</div><div><br></div><div>I go through a similar set of steps for Fink packages. If there is a GPG signature, I'll verify that, since it provides a little more chain-of-trust information. However, if I am just downloading a single file, it is typically easier to just verify the hash by inspection - that is, with the SHA256 on the web page rather than a separate file download.</div>
<div><br></div><div>Also, there is a bit more of an audit trail if the hash is in our web pages in SVN.</div></div></blockquote></div><br clear="all">I may be too far away, in other consideration...<br>but, are you saying that it would be better to embed the SHA256 hash directly on the web page, or simply that searching for this file may be too hard for the user?<br>
<br>for the former, the web page always need a modification for new publication (svn commit then push on www.n.o). So changing the stable release name, and at the same time adding the hash would not be a problem.<br><br>for the latter, the file is named <release-file>.sha256, so for example nut-2.6.0.tar.gz.sha256, which allows checking automation.<br>
<br>Or did I got you wrong?<br><br>cheers,<br>Arnaud<br>