Re: m5sums failing since last night

The file sizes are short. The contents are not recognized by tar.
False alarm. It was alarming to me because wget received them but not
others but clearly they are not duplicitous.

Thanks for your insight Ken Moffat! I am very confident in the
validity of the MD5 check results that passed based on your feedback.

On Wed, Sep 27, 2017 at 10:34 AM, Ken Moffat <[email protected]> wrote:
> On Wed, Sep 27, 2017 at 10:03:32AM -0700, Kaywan Joseph Mansubi wrote:
>> Since 9pm PDT last night (9/26/17) the md5sums have been failing on
>> some packages downloaded via the wgetlist provided via the Version
>> 8.1-systemd Chapter 3.1 LFS manual.
>>
>> This issue is ongoing as of 9:56am PDT 9/27/2017.
>>
>> Some packages are irretrievable.
>> expat-2.2.3.tar.bz2
>> expect5.45.tar.gz
>>
>>
>> Some packages pass.
>>
>> Some packages that are retrievable don't pass namely:
>> md5sum: WARNING: 5 computed checksums did NOT match
>> e2fsprogs-1.43.5.tar.gz: FAILED from sourceforge
>> procps-ng-3.3.12.tar.xz: FAILED from sourceforge
>> psmisc-23.1.tar.xz: FAILED from sourceforge
>> tcl-core8.6.7-src.tar.gz: FAILED from sourceforge
>> xz-5.2.3.tar.xz: FAILED from tukaani.org
>>
>>
>> sourceforge was 404 for awhile when I first discovered this last night.
>>
>> I wonder if we can trust the ones that do pass currently? At any rate,
>> anyone with an interest in security might want to notify responsible parties...
>>
>> I am able to get the correct sums using the packages from other sources, fyi.
>>
>> Best,
>>
>> KJM
>
> For me, sourceforge has been mostly offline for at least 20 hours,
> maybe longer. There seems to be a general problem with the sites of
> the owning company - yesterday slashdot was visible, but its links to
> areas within slashdot (tech., hardware., etc) had invalid
> certificates. Today that continues, but the front page has not been
> updated.
>
> As to the question about trust - an expected md5sum in LFS or BLFS
> only says that this is probably the same as what an editor tested.
> 'Probably' because it is theoretically possible to craft a corrupted
> file with the same md5sum as the original. Doing that to a source
> tarball and making it still compile will be somewhat harder, so for
> the moment I do not regard that as likely.
>
> If you still have the tarballs with different md5s, are the sizes ok
> (i.e. possibly recreated, maybe with different date/time values -
> contents would need to be compared, maybe part of it is garbage - or
> are they short (part is missing) ?
>
> ĸen
> --
> Truth, in front of her huge walk-in wardrobe, selected black leather
> boots with stiletto heels for such a barefaced truth.
>                                      - Unseen Academicals
> --
> http://lists.linuxfromscratch.org/listinfo/lfs-chat
> FAQ: http://www.linuxfromscratch.org/blfs/faq.html
> Unsubscribe: See the above information page
-- 
http://lists.linuxfromscratch.org/listinfo/lfs-chat
FAQ: http://www.linuxfromscratch.org/blfs/faq.html
Unsubscribe: See the above information page