Re: [gedit-list] Are there checksums to check downloads against for MSWindows installer?

["J. M. Rees" <jm07734rees gmail com>]

2014-05-09 15:57 GMT+09:00 Jesse van den Kieboom <jessevdk gnome org>:
> Added


Thanks.

If it wouldn't be too much of a bother, I'd like to ask one more
thing, to make things a bit more difficult for the MIM. Many projects
will post the actual checksums on the announcements list. Could I at
least have you confirm the contents of

http://ftp.gnome.org/pub/GNOME/binaries/win32/gedit/2.30/gedit-2.30.sha256sum

to be

a611e9c233321c29cf8307d94d37e5a9028b2d99bba9ecd06ebb9a670cfb29a2
gedit-setup-2.30.1-1.exe

The present interchange is good enough for my purposes, since I took
the download some time ago. (From memory, it matches to at least the
first four digits. But the machine is at work, so I'll check it again
on Monday before installing.) But others will want a separate path to
confirm the checksum, and confirming it here will provide that.

Hope it's not too much of a bother.

--
Joel Rees

> 2014-05-09 2:39 GMT+02:00 J. M. Rees <jm07734rees gmail com>:
> > Has the project posted checksums to check downloads against?
> >
> > I've been looking around <http://ftp.gnome.org/pub/GNOME/binaries/win32/gedit/2.30/>and searching the 
> > gnome servers and the web in general for checksums, but I don't see any.
> >
> > I have permission to install gedit on this MSWindows8 notebook at work, based on the assumption that I am 
> > fully confident that there will be no parasitic functionality installed in the process. In the present 
> > political climate, I no longer assume that tools like gedit will not be subject to MIM attacks, so I would 
> > like to see some assertion from the project that what I have is what the project has put up for download.
> >
> > As an alternative, I could download the installer from three or more mirrors and do a binary compare of 
> > each copy, but that's kind of abusing the bandwidth. I'm rather considering compiling from source, but I 
> > haven't been able to open up enough time yet. Would Cygwin or MinGW be the preferred environment for 
> > compiling for source, if checksums are not available for the installer downloads?
> >
> > --
> > Joel Rees
> >
> > _______________________________________________
> > gedit-list mailing list
> > gedit-list gnome org
> > https://mail.gnome.org/mailman/listinfo/gedit-list