MD5 checksum problems with some IIP downloads

mids <[email protected]> Sun, 22 Jun 2003 00:33:44 +0200
Newsgroups gmane.comp.security.invisiblenet.iip.devel
Message-ID <[email protected]>
PROBLEM:
md5sum of some sourceforge downloads are invalid

This is caused by 3 of the sourceforge mirror servers to send the
"Content-Encoding: x-gzip" header to the client (try wget -S). Mozilla
based browsers (for example) automatically gunzip the file. So the .tgz
becomes a .tar file. Which results in a different filesize, md5sum and
pgp signature.

When extracting, the contents is 100% the same though.

This bug is reported to SF, see:
http://sourceforge.net/tracker/index.php?func=detail&aid=747672&group_id=1&atid=200001

WORKAROUND:

Download the file from another mirror that doesn't send that
content-encoding header or use 'wget' to download.

CORRECT MD5SUMS (389385fd95c143834a58f2db0e3890f7):
http://cesnet.dl.sourceforge.net/sourceforge/invisibleip/iip-1.1.0.tgz
http://easynews.dl.sourceforge.net/sourceforge/invisibleip/iip-1.1.0.tgz 
http://flow.dl.sourceforge.net/sourceforge/invisibleip/iip-1.1.0.tgz 
http://switch.dl.sourceforge.net/sourceforge/invisibleip/iip-1.1.0.tgz 
http://twtelecom.dl.sourceforge.net/sourceforge/invisibleip/iip-1.1.0.tgz 
http://belnet.dl.sourceforge.net/sourceforge/invisibleip/iip-1.1.0.tgz 
http://heanet.dl.sourceforge.net/sourceforge/invisibleip/iip-1.1.0.tgz

INCORRECT MD5SUMS (2a783d726bc7a798bc6a8bf18b09c348):
http://umn.dl.sourceforge.net/sourceforge/invisibleip/iip-1.1.0.tgz 
http://aleron.dl.sourceforge.net/sourceforge/invisibleip/iip-1.1.0.tgz 
http://unc.dl.sourceforge.net/sourceforge/invisibleip/iip-1.1.0.tgz 

Thanks to CM for reporting this,

mids
-- 
PGP Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xF19326A9
Key fingerprint = 730D 9B3A F406 F28A 957D 6397 31E8 6D4C F193 26A9
signature.asc (application/pgp-signature, 189 B)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+9N1IMehtTPGTJqkRAnyEAJ9DdnbFnaJeZmAejetGEXVzsu5TzwCePp5t
Kaar2l4K/NL+k82SZcgjm3A=
=F0Kg
-----END PGP SIGNATURE-----