Subject: Bug#54 closed by Mike Gabriel <[email-masked]> (Checksums added to X2Go tarball and binary downloads)

From: [email-masked] (X2Go Bug Tracking System)
Date: Wed, 31 Oct 2012 22:18:02 +0000

This is an automatic notification regarding your Bug report
which was filed against the x2goclient package:

#54: Missing signatures for downloads

It has been closed by Mike Gabriel <[email-masked]>.

Their explanation is attached below along with your original report.
If this explanation is unsatisfactory and you have not received a
better one in a separate message then please contact Mike Gabriel <[email-masked]> by
replying to this email.

-- 
X2Go Bug Tracking System
Contact [email-masked] with problems

Subject: Checksums added to X2Go tarball and binary downloads
From: Mike Gabriel <[email-masked]>
To: [email-masked]
Cc: [email-masked], [email-masked]
Date: Wed, 31 Oct 2012 23:15:25 +0100

close #54
thanks

Hi Heinrich, hi all,

I have just added MD5, SHA1 and GPG signatures to all X2Go source  
tarball and binary downloads.

@Developers, esp. Alex:

The commands to use in the future for new uploads on

   http://code.x2go.org/releases

are:

   $ md5sum $tarball > $tarball.md5
   $ sha1sum $tarball > $tarball.sha1
   $ gpg -a -b --sign $tarball

The uploading developers sign the uploaded tarballs with their own GPG  
keys so.

Mike

-- 

DAS-NETZWERKTEAM
mike gabriel, rothenstein 5, 24214 neudorf-bornstein
fon: +49 (1520) 1976 148

GnuPG Key ID 0x25771B31
mail: [email-masked], http://das-netzwerkteam.de

freeBusy:
https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xfb

Subject: Missing signatures for downloads
From: "glpk xypron" <[email-masked]>
To: [email-masked]
Date: Fri, 26 Oct 2012 14:00:52 +0200

Package: x2goclient
Version: 3.99.2.1

Dear maintainer,

you offer downloads for the x2go client, e.g. on page
http://code.x2go.org/releases/binary-win32/x2goclient

Unfortunately you do not provide any possibility to verify if a downloaded file is authentic, or if during transfer a virus has been added.

Please, provide for each download a GPG signature and optionally SHA1 and MD5 hashs.

http://maven.apache.org/download.html
is a good examples except for the missing SHA1 hash. MD5 alone is not safe anymore.

Best regards

Heinrich Schuchardt