X2Go Bug report logs - #54
Missing signatures for downloads

Toggle useless messages

Message #5 received at submit@bugs.x2go.org (full text, mbox, reply):

From: "glpk xypron" <xypron.glpk@gmx.de>

To: submit@bugs.x2go.org

Subject: Missing signatures for downloads

Date: Fri, 26 Oct 2012 14:00:52 +0200

Package: x2goclient
Version: 3.99.2.1

Dear maintainer,

you offer downloads for the x2go client, e.g. on page
http://code.x2go.org/releases/binary-win32/x2goclient

Unfortunately you do not provide any possibility to verify if a downloaded file is authentic, or if during transfer a virus has been added.

Please, provide for each download a GPG signature and optionally SHA1 and MD5 hashs.

http://maven.apache.org/download.html
is a good examples except for the missing SHA1 hash. MD5 alone is not safe anymore.

Best regards

Heinrich Schuchardt

Message #10 received at 54@bugs.x2go.org (full text, mbox, reply):

From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

To: 54@bugs.x2go.org

Cc: 54-submitter@bugs.x2go.org, control@bugs.x2go.org

Subject: Checksums added to X2Go tarball and binary downloads

Date: Wed, 31 Oct 2012 23:15:25 +0100

[Message part 1 (text/plain, inline)]

close #54
thanks

Hi Heinrich, hi all,

I have just added MD5, SHA1 and GPG signatures to all X2Go source  
tarball and binary downloads.

@Developers, esp. Alex:

The commands to use in the future for new uploads on

  http://code.x2go.org/releases

are:

  $ md5sum $tarball > $tarball.md5
  $ sha1sum $tarball > $tarball.sha1
  $ gpg -a -b --sign $tarball

The uploading developers sign the uploaded tarballs with their own GPG  
keys so.

Mike

-- 

DAS-NETZWERKTEAM
mike gabriel, rothenstein 5, 24214 neudorf-bornstein
fon: +49 (1520) 1976 148

GnuPG Key ID 0x25771B31
mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de

freeBusy:
https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xfb

[Message part 2 (application/pgp-signature, inline)]

Send a report that this bug log contains spam.