Yeah, the SHA256.sig should be enough and just veify that everything is correct. If not, fetch the incorrect sets again. I just wanted to give a brief explaination on how I noticed this inconsistency. But yeah, thanks for pointing me to a better solution.
On Sat, Sep 23, 2017 at 05:12:32AM -0400, Ted Unangst wrote: > Raf Czlonka wrote: > > This is unrelated to your diff but what I do instead is to check > > the BUILDINFO file - it's tiny and all the information you need, > > is already there. > > While we're on the subject, I'll point out that sometimes only the base sets > change, but not the x sets. If you download SHA256 you can download only files > that differ. (This also may work better if you switch mirrors or the > timestamps drift for other reasons.) It's just a few lines of shell, though I > don't have them handy atm. > > (And for bonus points, you can use SHA256.sig and verify it's correct, then > verify that BUILDINFO hasn't been tampered with, etc...) > > ftp/http should still do the right thing, of course.
