Re: [gentoo-user] md5sum -c

[Mick]

On Friday 14 Mar 2014 06:34:25 Guido Budack wrote:
> Here the result with option-c:
>
> md5sum -c livedvd-amd64-multilib-20121221.iso
> md5sum: DVD-hybrid-amd64-blue.png: No such file or directory
> DVD-hybrid-amd64-blue.png: FAILED open or read
> md5sum: DVD-hybrid-amd64-purple.png: No such file or directory
> DVD-hybrid-amd64-purple.png: FAILED open or read
> md5sum: DVD-hybrid-x86-amd64-blue.png: No such file or directory
> DVD-hybrid-x86-amd64-blue.png: FAILED open or read
> md5sum: DVD-hybrid-x86-amd64-purple.png: No such file or directory
> DVD-hybrid-x86-amd64-purple.png: FAILED open or read
> md5sum: FINAL_4x3_gentoo_ten_Blue-1024-768-final.png: No such file or
> directory FINAL_4x3_gentoo_ten_Blue-1024-768-final.png: FAILED open or
> read
> md5sum: FINAL_4x3_gentoo_ten_Purple-1152-864.png: No such file or directory
> FINAL_4x3_gentoo_ten_Purple-1152-864.png: FAILED open or read
> md5sum: FINAL_4x3_gentoo_ten_Purple-1280-960-final.png: No such file or
> directory FINAL_4x3_gentoo_ten_Purple-1280-960-final.png: FAILED open or
> read md5sum: FINAL_4x3_gentoo_ten_Purple-1024-768-final.png: No such file
> or directory FINAL_4x3_gentoo_ten_Purple-1024-768-final.png: FAILED open
> or read md5sum: FINAL_4x3_gentoo_ten_Blue-1280-960-final.png: No such file
> or directory FINAL_4x3_gentoo_ten_Blue-1280-960-final.png: FAILED open or
> read
> md5sum: FINAL_4x3_gentoo_ten_Blue-1152-864.png: No such file or directory
> FINAL_4x3_gentoo_ten_Blue-1152-864.png: FAILED open or read
> md5sum: FINAL_4x3_gentoo_ten_Blue-800-600.png: No such file or directory
> FINAL_4x3_gentoo_ten_Blue-800-600.png: FAILED open or read
> md5sum: FINAL_4x3_gentoo_ten_Purple-800-600.png: No such file or directory
> FINAL_4x3_gentoo_ten_Purple-800-600.png: FAILED open or read
> md5sum: FINAL_widescreen-Blue-1920-1200-final.png: No such file or
> directory FINAL_widescreen-Blue-1920-1200-final.png: FAILED open or read
> md5sum: FINAL_widescreen-Blue-1440-900-final.png: No such file or directory
> FINAL_widescreen-Blue-1440-900-final.png: FAILED open or read
> md5sum: FINAL_widescreen-Blue-1920-1080-final.png: No such file or
> directory FINAL_widescreen-Blue-1920-1080-final.png: FAILED open or read
> md5sum: FINAL_widescreen-Blue-1600-900-final.png: No such file or directory
> FINAL_widescreen-Blue-1600-900-final.png: FAILED open or read
> md5sum: FINAL_widescreen-Blue-1280-800-final.png: No such file or directory
> FINAL_widescreen-Blue-1280-800-final.png: FAILED open or read
> md5sum: FINAL_widescreen-Blue-1280-720-final.png: No such file or directory
> FINAL_widescreen-Blue-1280-720-final.png: FAILED open or read
> md5sum: FINAL_widescreen-Purple-1920-1080-final.png: No such file or
> directory FINAL_widescreen-Purple-1920-1080-final.png: FAILED open or read
> md5sum: FINAL_widescreen-Purple-1280-720-final.png: No such file or
> directory FINAL_widescreen-Purple-1280-720-final.png: FAILED open or read
> md5sum: FINAL_widescreen-Purple-1280-800-final.png: No such file or
> directory FINAL_widescreen-Purple-1280-800-final.png: FAILED open or read
> md5sum: FINAL_widescreen-Purple-1920-1200-final.png: No such file or
> directory FINAL_widescreen-Purple-1920-1200-final.png: FAILED open or read
> md5sum: FINAL_widescreen-Purple-1440-900-final.png: No such file or
> directory FINAL_widescreen-Purple-1440-900-final.png: FAILED open or read
> md5sum: FINAL_widescreen-Purple-1600-900-final.png: No such file or
> directory FINAL_widescreen-Purple-1600-900-final.png: FAILED open or read
> md5sum: gentoo-flowers-1024.png: No such file or directory
> gentoo-flowers-1024.png: FAILED open or read
> md5sum: gentoo-flowers-1152.png: No such file or directory
> gentoo-flowers-1152.png: FAILED open or read
> md5sum: gentoo-flowers-1280.png: No such file or directory
> gentoo-flowers-1280.png: FAILED open or read
> md5sum: gentoo-flowers-800.png: No such file or directory
> gentoo-flowers-800.png: FAILED open or read
> md5sum: Jewel-Back-blue.png: No such file or directory
> Jewel-Back-blue.png: FAILED open or read
> md5sum: Jewel-Back-purple.png: No such file or directory
> Jewel-Back-purple.png: FAILED open or read
> md5sum: Jewel-Front-blue.png: No such file or directory
> Jewel-Front-blue.png: FAILED open or read
> md5sum: Jewel-Front-purple.png: No such file or directory
> Jewel-Front-purple.png: FAILED open or read
> md5sum: LICENSE: No such file or directory
> LICENSE: FAILED open or read
> md5sum: WARNING: 15504459 lines are improperly formatted
> md5sum: WARNING: 33 listed files could not be read

Guido, the above message shows that the md5sum command was NOT performed on 
the iso hash file, but on a bunch of .png files.  


In case you are not sure how to go about this, try the following.

1. Make sure that the iso file:

  livedvd-amd64-multilib-20121221.iso

and its hash file:

  livedvd-amd64-multilib-20121221.iso.DIGESTS

are both saved in the same directory.  'cd' into the same directory.


Depending on how paranoid you want to be with regards to checking the 
integrity of the downloads, you can also get the gpg signature of the file 
with the hashes and check that it has not been tampered with.  First fetch the 
gentoo gpg keys.  Use the KeyID of the (non-expired) keys from here:

  http://www.gentoo.org/proj/en/releng/index.xml

and run 'gpg --keyserver subkeys.pgp.net --recv-keys <key id>'.  For example:

gpg --keyserver subkeys.pgp.net --recv-keys 0xDB6B8C1F96D8BF6D


Download the signed file of the hashes:

 livedvd-amd64-multilib-20121221.iso.DIGESTS.asc


Then check the integrity of it:

 gpg --verify livedvd-amd64-multilib-20121221.iso.DIGESTS.asc

You should get something like:

[snip ...]

gpg: Good signature from "Gentoo Linux Release Engineering (Gentoo Linux 
Release Signing Key) <releng@g.o>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: D99E AC73 79A8 50BC E47D  A5F2 9E64 38C8 1707 2058
gpg: textmode signature, digest algorithm SHA1

Ignore the warning: "WARNING: This key is not certified with a trusted 
signature!" which is correct, unless you have manually edited the trust of 
this gpg key in your keyring.  The line above it tells you that the signature 
is good and therefore you can trust the hashes in there.

Now, running:

 md5sum -c livedvd-amd64-multilib-20121221.iso.DIGESTS.asc

should show:

livedvd-amd64-multilib-20121221.iso: OK

for the iso image.  Any files listed in the DIGESTS file which you have not 
downloaded or saved in the same directory, will be shown as FAILED, e.g.

md5sum: livedvd-amd64-multilib-20121221.iso.CREDITS: No such file or directory
livedvd-amd64-multilib-20121221.iso.CREDITS: FAILED open or read

This is all explained here:

 http://www.gentoo.org/doc/en/handbook/handbook-amd64.xml?part=1&chap=2

Hope this helps. 

-- 
Regards,
Mick