Bug 336492

Summary:	ftp.kde.org should include MD5 files for files
Product:	[Websites] www.kde.org	Reporter:	Hanspeter Niederstrasser <niederstrasser>
Component:	general	Assignee:	kde-www mailing-list <kde-www>
Status:	RESOLVED INTENTIONAL
Severity:	normal
Priority:	NOR
Version:	unspecified
Target Milestone:	---
Platform:	unspecified
OS:	Other
Latest Commit:		Version Fixed In:

Description Hanspeter Niederstrasser 2014-06-20 12:18:11 UTC

The directories in ftp.kde.org should include MD5SUMS files for each source directory.  This makes it easy to get the hashes, especially for packagers who would otherwise have to download the tarballs, calculate hash, then redownload using the distro recipe.

Reproducible: Always




Calligra already does this in their directory: ftp://ftp.kde.org/pub/kde/stable/calligra-2.8.3/MD5SUMS
Would be nice if the main kde src folder also did: ftp://ftp.kde.org/pub/kde/stable/4.13.2/src/

Comment 1 Ben Cooksley 2014-06-20 12:20:41 UTC

ftp.kde.org is an unsupported service and should not be in use.
All access to KDE source tarballs should be via download.kde.org, which provides .md5 and .sha1 files for all files it hosts.

In any case, we won't be adding such files because they can easily be compromised by an attacker who has gained control of a given mirror.