Bug#932943: Missing SHA512 and gpg signature

2019-08-05 Thread Jeremy Stanley
On 2019-08-05 11:41:34 +0200 (+0200), Bastian Blank wrote: > On Sun, Aug 04, 2019 at 10:05:32PM +0100, Chris Boot wrote: > > On 04/08/2019 17:29, Bastian Blank wrote: [...] > > > No, don't. Use base64 like everyone else. > > > > I strongly disagree with this. Practically everyone else uses > >

Bug#932943: Missing SHA512 and gpg signature

2019-08-05 Thread Bastian Blank
On Sun, Aug 04, 2019 at 10:05:32PM +0100, Chris Boot wrote: > On 04/08/2019 17:29, Bastian Blank wrote: > > Only one of them. And I would go directly to SHA3 for new stuff. > > Buster doesn't have any SHA3 tools in coreutils. While I don't have > anything against calculating such checksums in

Bug#932943: Missing SHA512 and gpg signature

2019-08-05 Thread Thomas Goirand
On 8/4/19 6:29 PM, Bastian Blank wrote: > On Sat, Aug 03, 2019 at 03:06:39PM +0100, Chris Boot wrote: >> - Which checksums should we include? Our Apt repos use MD5 and SHA-256, >> and our ISOs use MD5, SHA-1, SHA-256 and SHA-512. I'd be inclined to >> suggest SHA-256 and SHA-512 only, personally.

Bug#932943: Missing SHA512 and gpg signature

2019-08-04 Thread Chris Boot
On 04/08/2019 17:29, Bastian Blank wrote: > On Sat, Aug 03, 2019 at 03:06:39PM +0100, Chris Boot wrote: >> - Which checksums should we include? Our Apt repos use MD5 and SHA-256, >> and our ISOs use MD5, SHA-1, SHA-256 and SHA-512. I'd be inclined to >> suggest SHA-256 and SHA-512 only,

Bug#932943: Missing SHA512 and gpg signature

2019-08-04 Thread Steve McIntyre
On Sun, Aug 04, 2019 at 08:38:38PM +0200, Thomas Lange wrote: >> On Sun, 4 Aug 2019 18:29:30 +0200, Bastian Blank said: > >>> In each case I expect the values to be hex strings, effectively the same >>> as the first column of the output from sha1sum, sha256sum, sha512sum, >>>

Bug#932943: Missing SHA512 and gpg signature

2019-08-04 Thread Thomas Lange
> On Sun, 4 Aug 2019 18:29:30 +0200, Bastian Blank said: >> In each case I expect the values to be hex strings, effectively the same >> as the first column of the output from sha1sum, sha256sum, sha512sum, >> etc... from coreutils. > No, don't. Use base64 like everyone

Bug#932943: Missing SHA512 and gpg signature

2019-08-04 Thread Bastian Blank
On Sat, Aug 03, 2019 at 09:23:58PM +0100, Chris Boot wrote: > Currently the build tools generate the raw image using FAI, then wrap it > into a tarball. The tarball is then xz compressed outside > debian-cloud-images in the GitLab CI job. > Is there any reason to keep it that way? Why don't we

Bug#932943: Missing SHA512 and gpg signature

2019-08-04 Thread Bastian Blank
On Sat, Aug 03, 2019 at 03:06:39PM +0100, Chris Boot wrote: > - Which checksums should we include? Our Apt repos use MD5 and SHA-256, > and our ISOs use MD5, SHA-1, SHA-256 and SHA-512. I'd be inclined to > suggest SHA-256 and SHA-512 only, personally. Only one of them. And I would go directly

Bug#932943: Missing SHA512 and gpg signature

2019-08-03 Thread Chris Boot
On 03/08/2019 11:06, Chris Boot wrote: > On 25/07/2019 00:00, Thomas Goirand wrote: >> On the secret files found here: >> http://cloud.debian.org/cdimage/cloud/ >> >> there's a json file attached. Unfortunately, there's no SHA512, and of >> course, no GPG signature of this file, so it's impossible

Bug#932943: Missing SHA512 and gpg signature

2019-08-03 Thread Chris Boot
On 25/07/2019 00:00, Thomas Goirand wrote: > On the secret files found here: > http://cloud.debian.org/cdimage/cloud/ > > there's a json file attached. Unfortunately, there's no SHA512, and of > course, no GPG signature of this file, so it's impossible check the validity > of the images. Please

Bug#932943: Missing SHA512 and gpg signature

2019-07-24 Thread Thomas Goirand
Package: cloud.debian.org Severity: important On the secret files found here: http://cloud.debian.org/cdimage/cloud/ there's a json file attached. Unfortunately, there's no SHA512, and of course, no GPG signature of this file, so it's impossible check the validity of the images. Please at least