Re: Using sha512 checksum for default in CD/verify page

Le 25/09/2016 à 22:02, Holger Wansing a écrit :
> Hi,
> 
> Stéphane Blondon <[email protected]> wrote:
>>  To validate the contents of a CD image, just be sure to use the
>>  appropriate checksum tool.
>> -For older archived CD releases, only MD5 checksums were generated in
>> -the <code>MD5SUMS</code> files; you should use the tool
>> -<code>md5sum</code> to work with these.
>> -For newer releases, newer and cryptographically stronger checksum
>> -algorithms (SHA1, SHA256 and SHA512) are used, and there are equivalent
>> -tools available to work with these.
>> +For recent releases, cryptographically strong checksum
>> +algorithms (SHA256 and SHA512) are used; you should use the tools
>> +<code>sha256sum</code> or <code>sha512sum</code> to work with these.
>> +For older archived CD releases, if only MD5 checksums were generated in
>> +the <code>MD5SUMS</code> files, you should use the tool
>> +<code>md5sum</code>.
>>  </p>
> 
> For the second sentence, maybe better use something like:
> 
> For older archived CD releases you will probably have to use the 
> <code>md5sum</code> tool, since only MD5 checksums might have been 
> generated for that releases.


After checking in the archive, MD5 checksum only is for very old releases:

v.7: SHA512, SHA256, SHA1, MD5
v.6: SHA512, SHA256, SHA1, MD5
v.5: SHA1, MD5
v.4: SHA1, MD5
v.3.1: MD5

So what do you think about:

'''
For CD releases older than Debian 6, you have to use the
<code>sha1sum</code> or <code>md5sum</code> tools, depending which
checksums have been generated for that releases.
'''



sources:
http://cdimage.debian.org/cdimage/archive/7.0.0/amd64/iso-cd/
http://cdimage.debian.org/cdimage/archive/6.0.0/amd64/jigdo-cd/
http://cdimage.debian.org/cdimage/archive/5.0.0/amd64/iso-cd/
http://cdimage.debian.org/cdimage/archive/4.0_r0/amd64/iso-cd/
http://cdimage.debian.org/cdimage/archive/3.1_r0/i386/iso-cd/


-- 
Stéphane

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJX6MyuAAoJEKK5G8bNTr3cLM4P/2R+BwajOoQHh+uhd3LgKb6z
dvieiXhDONWwLICiTVfIDpZmkEbllNuKLIThjxOx6A448BrnA2hzy4XM/UpOm8SF
GfHol/xLDuRm7BkOmjIjHckOUkHdO5jbMrgLT5jXTklRSWQn4ZlgtSwM+d5UejUM
t6iYEvZESyyGsezKRil3ylKvR1DgBnLDFJXdzzHKxSFSBAwKTuALgA7tQ7mk10B7
h+G4fMbZSqkthmkXR2p+TRc6QuDEhDdLHnRE3naKBYMq16pg+cYFLxvF4dFb4I/f
IYaJ+McffYpP0HQevhttGPC1KiJUjOvs882lMI1MJOHUmLyUdWUqASyHDronNanQ
5ZcRspb0aHVz2aMxQQcF1bz7XQjuWq+WnL3ixX1avFYycTDm3TSrCX1po6IEBUZy
u8uTLm9l6UpeyA7ozzhbTZL5pyKH16X/M4QXJJyf09XFd8BMFxuwnncHu3loQS5+
SUHQH70ZtNbPOcTLvX7Or7bb+xqXrHKbNG1tYyG+rAOf9Rtd8TqLYpyTgmCwHbwW
pvK3jMu+zoHkBLGWJE/U4t+AqZyYGoYeXwQZyGeCd4L4E/3uWL7q3ni4LSyvMjk6
jCULeyPyrF46ua+qu8K+ZAx1ChxFEt2B/wmKqS0ALHBywSDwYxW7oBx03AKtXZQe
/5m3Px+MFjfbj4Jd+iqJ
=sYpM
-----END PGP SIGNATURE-----