Date: Thu, 2 Jan 2003 22:40:02 -0800 (PST) From: Mike Meyer <mwm-dated-1042007519.1c4605@mired.org> To: freebsd-bugs@FreeBSD.org Subject: Re: bin/46629: md5 checking is a PITA. Message-ID: <200301030640.h036e2gT082609@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
The following reply was made to PR bin/46629; it has been noted by GNATS. From: Mike Meyer <mwm-dated-1042007519.1c4605@mired.org> To: "Sergey N. Voronkov" <serg@tmn.ru> Cc: FreeBSD-gnats-submit@FreeBSD.ORG Subject: Re: bin/46629: md5 checking is a PITA. Date: Fri, 3 Jan 2003 00:31:57 -0600 In <20021231042916.GA4654@sv.tech.sibitex.tmn.ru>, Sergey N. Voronkov <serg@tmn.ru> typed: > On Mon, Dec 30, 2002 at 08:31:08AM -0000, Mike Meyer wrote: > > >Description: > > Checking md5 checksums is an error-prone process. > > >How-To-Repeat: > > Download something that includes the output of md5 as a CHECKSUMS > > file. Notice that to confirm the checksum requires verifying the > > rather long and unpatterned checksum string by eye. > > >Fix: > > > > md5 should have a "-c file" option, which expects the output of md5 to > > be in file, and confirms that the files listed in "file" exist and match > > the associated checksums. > > > > Yes, this requires trusting the mdd5 binary. On the other hand, very few > > things one is interested in downloading don't require trusting some > > system utility, like the c compiler. So this is at worst a marginal change > > in the security given by the md5 checksums to start yes. > > > > Yes, this is trivial to script. It shouldn't be required of every user. > > > > Finally, FWIW, I have an Eiffel version of md5 that implements the > > -c option, but is missing the standard options of md5. It's available > > on request. > > > > #cd /var/ftp/pub/FreeBSD/releases/i386/4.7-RELEASE-p2/bin/ > #md5 [a-z]* | diff - CHECKSUM.MD5 > > Looks like verifying is simple with current version. :-)) No, one special case is very simple. Your example quits working as soon as any of the tarballs start with an upper case letter, or if the md5 sum file doesn't have the files in ascii sort order, or if some of the files listed are in subdirectories - all of which md5 will gladly do if invoked. For instance, I did: /sbin/md5 xc/* LimeWireLinux.tgz > CHECKSUM.MD5 and generated an CHECKSUM.MD5 file that does all three of those things. Having to recreate the arguments handed to md5 to get correct results is silly when MD5 already has all the information it needs to check the files listed in the MD5 file. <mike -- Mike Meyer <mwm@mired.org> http://www.mired.org/consulting.html Independent WWW/Perforce/FreeBSD/Unix consultant, email for more information. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200301030640.h036e2gT082609>