2 ms·
For Debian, the author says: "Official releases of Debian CDs come with signed checksum files; look for them alongside the images in the iso-cd, jigdo-dvd, iso
by vbernat 10y ago
For Debian, the author says:
"Official releases of Debian CDs come with signed checksum files; look for them alongside the images in the iso-cd, jigdo-dvd, iso-hybrid etc. directories." No directory or direct links are provided. Verification instructions are not linked to from the download page.
I do:
- https://www.debian.org/ https://www.debian.org/
- https://www.debian.org/CD/ https://www.debian.org/CD/
- https://www.debian.org/CD/http-ftp/ https://www.debian.org/CD/http-ftp/
- https://www.debian.org/CD/http-ftp/#stable https://www.debian.org/CD/http-ftp/#stable
- http://cdimage.debian.org/debian-cd/8.5.0/amd64/iso-cd/ http://cdimage.debian.org/debian-cd/8.5.0/amd64/iso-cd/
And here, along the images, there are difficult to miss (and GPG-signed) SHA256SUMS and SHA512SUMS files. Moreover, the last page clearly links the verification instructions in the "How can I verify my download is correct and exactly what has been created by Debian?" section.
- qfx3 10y agoHmm... I do: - https://www.debian.org/ https://www.debian.org/ - Click "Getting Debian"... - https://www.debian.org/distrib/ https://www.debian.org/distrib/ (no signatures, no checksums, no "verify" link) - Click "Download an installation image"... - https://www.debian.org/distrib/netinst https://www.debian.org/distrib/netinst (no signatures, no checksums, no "verify" link) - Click on my architecture, the ISO download starts - The file is now on my machine and I have not seen the words "signature", "GPG", "checksum", or "verify" anywhere. I eventually found https://www.debian.org/CD/verify https://www.debian.org/CD/verify using a Google search. It's safe to say there is room for improvement here.