On 12/06/2023 16.57, Tim via users wrote:
Hi,
Having just downloaded a couple of F38 spins to try, I had a look at
the verify instructions (both identical) on
https://fedoraproject.org/spins/mate/download/
https://fedoraproject.org/spins/kde/download/
------------------------ begin paste ------------------------
Verify your download
Verify your download for security and integrity using the proper
checksum file. If there is a good signature from one of the Fedora
keys, and the SHA256 checksum matches, then the download is valid.
Download the checksum file into the same directory as the image you downloaded.
Import Fedora's GPG key(s)
curl -O
https://fedoraproject.org/fedora.gpg
You can verify the details of the GPG key(s) here.
Verify the checksum file is valid
gpgv --keyring ./fedora.gpg Fedora-Spins-38-1.6-x86_64-CHECKSUM
Verify the checksum matches
sha256sum -c Fedora-Spins-38-1.6-x86_64-CHECKSUM
If the output states that the file is valid, then it's ready to use!
--------------------- end paste ----------------------
The "download the checksum file" bit contians a link to download the
checksum with your browser. Fair enough, but since there were command
lines to copy and paste for the other two bits, I would have put a
command line to fetch the checksum, too.
And I wish that sha256sum command output was a bit more structured or
controllable, the blob it outputs isn't the easiest thing to read:
Use sha256sum --ignore-missing -c ...
------------------------ begin paste ------------------------
$ sha256sum -c Fedora-Spins-38-1.6-x86_64-CHECKSUM
sha256sum: Fedora-Budgie-Live-x86_64-38-1.6.iso: No such file or directory
Fedora-Budgie-Live-x86_64-38-1.6.iso: FAILED open or read
sha256sum: Fedora-Cinnamon-Live-x86_64-38-1.6.iso: No such file or directory
Fedora-Cinnamon-Live-x86_64-38-1.6.iso: FAILED open or read
Fedora-KDE-Live-x86_64-38-1.6.iso: OK
sha256sum: Fedora-LXDE-Live-x86_64-38-1.6.iso: No such file or directory
Fedora-LXDE-Live-x86_64-38-1.6.iso: FAILED open or read
sha256sum: Fedora-LXQt-Live-x86_64-38-1.6.iso: No such file or directory
Fedora-LXQt-Live-x86_64-38-1.6.iso: FAILED open or read
Fedora-MATE_Compiz-Live-x86_64-38-1.6.iso: OK
sha256sum: Fedora-SoaS-Live-x86_64-38-1.6.iso: No such file or directory
Fedora-SoaS-Live-x86_64-38-1.6.iso: FAILED open or read
sha256sum: Fedora-Sway-Live-x86_64-38-1.6.iso: No such file or directory
Fedora-Sway-Live-x86_64-38-1.6.iso: FAILED open or read
sha256sum: Fedora-Xfce-Live-x86_64-38-1.6.iso: No such file or directory
Fedora-Xfce-Live-x86_64-38-1.6.iso: FAILED open or read
sha256sum: Fedora-i3-Live-x86_64-38-1.6.iso: No such file or directory
Fedora-i3-Live-x86_64-38-1.6.iso: FAILED open or read
sha256sum: WARNING: 19 lines are improperly formatted
sha256sum: WARNING: 8 listed files could not be read
--------------------- end paste ----------------------
I would have spaced that out better for humans to read, perhaps list
the non-existent files separately, or have an option to skip them.
Bizarrely, there is an option to say nothing about the OK files.
--
Eyal Lebedinsky (fedora(a)eyal.emu.id.au)