From unknown Tue Apr 07 17:09:51 2026 MIME-Version: 1.0 X-Mailer: MIME-tools 5.502 (Entity 5.502) X-Loop: git-admin@x2go.org From: git-admin@x2go.org (X2Go Bug Tracking System) Subject: Bug#54 closed by Mike Gabriel (Checksums added to X2Go tarball and binary downloads) Message-ID: References: <20121031231525.15122ewa34wzb27x@mail.das-netzwerkteam.de> X-X2go-PR-Message: they-closed 54 X-X2go-PR-Package: x2goclient X-X2go-PR-Source: x2goclient Date: Wed, 31 Oct 2012 22:18:02 +0000 Content-Type: multipart/mixed; boundary="----------=_1351721882-2746-0" This is a multi-part message in MIME format... ------------=_1351721882-2746-0 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 This is an automatic notification regarding your Bug report which was filed against the x2goclient package: #54: Missing signatures for downloads It has been closed by Mike Gabriel . Their explanation is attached below along with your original report. If this explanation is unsatisfactory and you have not received a better one in a separate message then please contact Mike Gabriel by replying to this email. --=20 X2Go Bug Tracking System Contact git-admin@x2go.org with problems ------------=_1351721882-2746-0 Content-Type: message/rfc822 Content-Disposition: inline Content-Transfer-Encoding: 7bit Received: (at control) by bugs.x2go.org; 31 Oct 2012 22:15:27 +0000 Received: from freya.das-netzwerkteam.de (freya.das-netzwerkteam.de [88.198.48.199]) by ymir (Postfix) with ESMTPS id D3B525DB0D; Wed, 31 Oct 2012 23:15:26 +0100 (CET) Received: from grimnir.das-netzwerkteam.de (grimnir.das-netzwerkteam.de [78.46.204.98]) by freya.das-netzwerkteam.de (Postfix) with ESMTPS id 95D4FB60; Wed, 31 Oct 2012 23:15:26 +0100 (CET) Received: from localhost (localhost [127.0.0.1]) by grimnir.das-netzwerkteam.de (Postfix) with ESMTP id ED4533BBF9; Wed, 31 Oct 2012 23:15:25 +0100 (CET) X-Virus-Scanned: Debian amavisd-new at grimnir.das-netzwerkteam.de Received: from grimnir.das-netzwerkteam.de ([127.0.0.1]) by localhost (grimnir.das-netzwerkteam.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NqC01XUy7n5Z; Wed, 31 Oct 2012 23:15:25 +0100 (CET) Received: from localhost (localhost [127.0.0.1]) by grimnir.das-netzwerkteam.de (Postfix) with ESMTP id C4C123BC02; Wed, 31 Oct 2012 23:15:25 +0100 (CET) Received: from localhost (localhost [127.0.0.1]) by grimnir.das-netzwerkteam.de (Postfix) with ESMTP id 9BC283BBF9; Wed, 31 Oct 2012 23:15:25 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on grimnir.das-netzwerkteam.de X-Spam-Flag: NO X-Spam-Status: No, hits=-2.9 required=5.0 tests=ALL_TRUSTED,BAYES_00 autolearn=ham version=3.3.1 running as userid= X-Spam-Level: X-Spam-Bayes-Score: 0.0000 Received: by grimnir.das-netzwerkteam.de (Postfix, from userid 33) id 58CB73BC02; Wed, 31 Oct 2012 23:15:25 +0100 (CET) Received: from 43-8-142-46.pool.kielnet.net (43-8-142-46.pool.kielnet.net [46.142.8.43]) by mail.das-netzwerkteam.de (Horde Framework) with HTTP; Wed, 31 Oct 2012 23:15:25 +0100 Message-ID: <20121031231525.15122ewa34wzb27x@mail.das-netzwerkteam.de> X-Priority: 3 (Normal) Date: Wed, 31 Oct 2012 23:15:25 +0100 From: Mike Gabriel To: 54@bugs.x2go.org Cc: 54-submitter@bugs.x2go.org, control@bugs.x2go.org Subject: Checksums added to X2Go tarball and binary downloads MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=_2c7cohqvusjh"; protocol="application/pgp-signature"; micalg="pgp-sha1" Content-Transfer-Encoding: 7bit User-Agent: Internet Messaging Program (IMP) H3 (4.3.4) This message is in MIME format and has been PGP signed. --=_2c7cohqvusjh Content-Type: text/plain; charset=UTF-8; DelSp="Yes"; format="flowed" Content-Disposition: inline Content-Transfer-Encoding: 7bit close #54 thanks Hi Heinrich, hi all, I have just added MD5, SHA1 and GPG signatures to all X2Go source tarball and binary downloads. @Developers, esp. Alex: The commands to use in the future for new uploads on http://code.x2go.org/releases are: $ md5sum $tarball > $tarball.md5 $ sha1sum $tarball > $tarball.sha1 $ gpg -a -b --sign $tarball The uploading developers sign the uploaded tarballs with their own GPG keys so. Mike -- DAS-NETZWERKTEAM mike gabriel, rothenstein 5, 24214 neudorf-bornstein fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xfb --=_2c7cohqvusjh Content-Type: application/pgp-signature Content-Description: Digitale PGP-Unterschrift Content-Disposition: inline Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) iQIcBAABAgAGBQJQkaL9AAoJEJr0azAldxsxdc0P/Ajty205ayoraa7qNM10MMXB mRyOlz9XLCOsZOTQSw73Q6Z/ZbUe/Hi3JLOO5QEqRaEkAfI63gjnJT5eKCtQrDwm t9l1ZqzmmlqBti1K/KSsTCl1FL8VnjXs7kDh8FSIh7pdMac5COEHOLlvLdaUuo17 +0fYwqWpqsJOjJRaq22sVGh97x3hKTRJiXjIPQo8AGAyzdapSRWIOdTBtbykawXi L2+r72ajmgX82ibez96btimTT9ZAeYFRYmI7va6Tu/xIkOOvZP0kaqgCDOy4JBHE mmdSJNzrei9JKZ9UMD/tSz4uR2EnToqL6IqT75m/SdLefXbNJOX55nvurcShtD4o AuMNOSTbQ+CMpb872ltkdWjuRw0KWGb1+hiBvXET8dLL9T05myMf3ayT26bVBdVU hlwSNSTLrO7QSOYnBGCw18FpHLGFvQTcjREpErxOpp0kHyWwVV+E3IdfXsBc7iTY PeL6t2qtXziQxNILY+mOHv3B6QgqoqTYSwB9LBUDfOoiNCBVv5808amU2ydTQqfj LBTAAHkOAxsNqMrbPUKJTRUpWXstKsy60t5KvzJ4xUS9DdPwGwZFcNWoX0ywPo6f 6vs7b1FPRY0lK88e42mtLKnYDcrsw+8k9ifuTxqDCB0Fj5p+pbxGYX/tb2gRy2Fr Pf2y6esi23GedFnQJyiB =M2qa -----END PGP SIGNATURE----- --=_2c7cohqvusjh-- ------------=_1351721882-2746-0 Content-Type: message/rfc822 Content-Disposition: inline Content-Transfer-Encoding: 7bit Received: (at submit) by bugs.x2go.org; 26 Oct 2012 12:00:54 +0000 Received: from mailout-de.gmx.net (mailout-de.gmx.net [213.165.64.23]) by ymir (Postfix) with SMTP id 109175DB0A for ; Fri, 26 Oct 2012 14:00:54 +0200 (CEST) Received: (qmail 10198 invoked by uid 0); 26 Oct 2012 12:00:53 -0000 Received: from 212.64.228.100 by www026.gmx.net with HTTP; Fri, 26 Oct 2012 14:00:51 +0200 (CEST) Content-Type: text/plain; charset="utf-8" Date: Fri, 26 Oct 2012 14:00:52 +0200 From: "glpk xypron" Message-ID: <20121026120052.198450@gmx.net> MIME-Version: 1.0 Subject: Missing signatures for downloads To: submit@bugs.x2go.org X-Authenticated: #41704822 X-Flags: 0001 X-Mailer: WWW-Mail 6100 (Global Message Exchange) X-Priority: 3 X-Provags-ID: V01U2FsdGVkX1+8xl4oLuS8El9qH3847imr+nzxNZlkaTTWhddOi9 gKnqpTfK2AX8eekeq0enwCbFSCG/tkg/l49A== Content-Transfer-Encoding: 8bit X-GMX-UID: Ix74cOEseSEqMhc+F3YhAgR+IGRvb8CC Package: x2goclient Version: 3.99.2.1 Dear maintainer, you offer downloads for the x2go client, e.g. on page http://code.x2go.org/releases/binary-win32/x2goclient Unfortunately you do not provide any possibility to verify if a downloaded file is authentic, or if during transfer a virus has been added. Please, provide for each download a GPG signature and optionally SHA1 and MD5 hashs. http://maven.apache.org/download.html is a good examples except for the missing SHA1 hash. MD5 alone is not safe anymore. Best regards Heinrich Schuchardt ------------=_1351721882-2746-0--