Re: MD5s of setup.exe on mirrors.

[Christopher Faylor <cgf-use-the-mailinglist-please at cygwin dot com>]

On Fri, May 11, 2007 at 12:58:59PM -0700, Alexander Sotirov wrote:
>ls-cygwin-2006@m-e-leypold.de wrote:
>> Cygwin mirrors have in their toplevel a setup.exe and an md5.sum. The
>> m5sum is
>> 
>>   ae1944f528338033bab3b4710d5bd736  setup.bz2
>>   b31ddcef84f25919a5d3184167b4a90d  setup.exe
>>   0503889504b7ff0b23e65586a522b3ad  setup.ini
>> 
>> whereas the setup.exe has actually the md5sum:
>> 
>>   fbc848393ed05ef4f51a253f75bcafeb
>> 
>> I checked that for ftp://mirror.switch.ch/mirror/cygwin/setup.exe and
>> ftp://ftp.mirror.ac.uk/sites/sources.redhat.com/ftp/cygwin/setup.exe
>> and some others.
>
>I reported this in January: http://cygwin.com/ml/cygwin/2007-02/msg00006.html
>
>Nobody seemed to care. Considering the fact that MD5 collisions are now trivial
>to generate, it probably doesn't matter much anyways - the fact that your copy
>of setup.exe has the right MD5 doesn't mean that it hasn't been tampered with.

We don't control the content of mirrors.

If you think this is an issue, contact the mirror(s) in question.

cgf

--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/