[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: pkg netlist
From: |
David Bateman |
Subject: |
Re: pkg netlist |
Date: |
Wed, 28 Feb 2007 11:39:02 +0100 |
User-agent: |
Thunderbird 1.5.0.7 (X11/20060921) |
John W. Eaton wrote:
> On 27-Feb-2007, David Bateman wrote:
>
> | I added code to the octave-forge CVS to create a file with the MD5 sum
> | of all of the package files and add it to the website. I've uploaded it
> | to the test website in
> |
> | http://octave.dbateman.org/packages.md5
> |
> | You should be able to use this file to identify the new packages and
> | check the integrity of downloaded files.
>
> I think it has been mentioned before that looking at checksums is not
> a very useful check if the checksum files are distributed alongside
> the packages because if the packages have been replaced with some
> counterfeit version, then it is likely that the checksum file has also
> been replaced.
>
They are only on the same machine at the moment. Eventually packages.md5
will be on the website on octave.sourceforge.net and the packages
themselves on the sourceforge mirrors that are referenced through
downloads.sourceforge.net. Therefore, the chances that both are
corrupted is minimized. See
address@hidden:~$ host octave.sourceforge.net
octave.sourceforge.net CNAME projects.sourceforge.net
projects.sourceforge.net A 66.35.250.209
address@hidden:~$ host downloads.sourceforge.net
downloads.sourceforge.net CNAME sourceforge.net
sourceforge.net A 66.35.250.203
> | This would be easier if the m5sum function I sent earlier today was
> | in octave :-)
>
> It's fine with me if you add that. My only question is whether
> md5.{h,c} files are the best to use, mostly from a licensing point of
> view. Are there any implementations available that are GPL?
>
I went to the source and took the sample implementation of the RSA
themselves, also the license seems to be GPL compatible to me. However,
we could always take the code from the gnu coreutils themselves. Note
that md5.{c,h} in the coreutils are autogenerated in recent versions,
and the last non autogenerated versions are available at
http://cvs.savannah.gnu.org/viewcvs/coreutils/lib/Attic/md5.h?root=coreutils&rev=1.21&hideattic=0&view=markup
http://cvs.savannah.gnu.org/viewcvs/coreutils/lib/Attic/md5.c?root=coreutils&rev=1.28&hideattic=0&view=markup
A reason to reject either of the above versions however is that a native
C++ implementation might be nicer. However, I failed to find one ready
made in C++. Even python uses C code, as can be seen in
http://svn.python.org/view/python/trunk/Modules/md5.c?rev=45465&view=auto
Perhaps the best starting point for a C++ implementation is the
gnu-crypto library Java implementation of MD5 at
http://cvs.savannah.gnu.org/viewcvs/gnu-crypto/source/gnu/crypto/hash/MD5.java?rev=1.7&root=gnu-crypto&view=auto
John, can state whether you want a C++ implementation of MD5 and if a C
implementation is ok, can you pick one of the above implementations?
Regards
David
> jwe
>
>
--
David Bateman address@hidden
Motorola Labs - Paris +33 1 69 35 48 04 (Ph)
Parc Les Algorithmes, Commune de St Aubin +33 6 72 01 06 33 (Mob)
91193 Gif-Sur-Yvette FRANCE +33 1 69 35 77 01 (Fax)
The information contained in this communication has been classified as:
[x] General Business Information
[ ] Motorola Internal Use Only
[ ] Motorola Confidential Proprietary
- pgk netlist, Bob Weigel, 2007/02/21
- Re: pkg netlist, David Bateman, 2007/02/27
- Re: pkg netlist, Bob Weigel, 2007/02/27
- Re: pkg netlist, John W. Eaton, 2007/02/27
- Re: pkg netlist,
David Bateman <=
- Re: pkg netlist, John W. Eaton, 2007/02/28