Re: pkg netlist

[David Bateman]

John W. Eaton wrote:
> On 27-Feb-2007, David Bateman wrote:
>
> | I added code to the octave-forge CVS to create a file with the MD5 sum
> | of all of the package files and add it to the website. I've uploaded it
> | to the test website in
> | 
> | http://octave.dbateman.org/packages.md5
> | 
> | You should be able to use this file to identify the new packages and
> | check the integrity of downloaded files.
>
> I think it has been mentioned before that looking at checksums is not
> a very useful check if the checksum files are distributed alongside
> the packages because if the packages have been replaced with some
> counterfeit version, then it is likely that the checksum file has also
> been replaced.
>   
They are only on the same machine at the moment. Eventually packages.md5
will be on the website on octave.sourceforge.net and the packages
themselves on the sourceforge mirrors that are referenced through
downloads.sourceforge.net. Therefore, the chances that both are
corrupted is minimized. See

address@hidden:~$ host octave.sourceforge.net
octave.sourceforge.net  CNAME   projects.sourceforge.net
projects.sourceforge.net        A       66.35.250.209
address@hidden:~$ host downloads.sourceforge.net
downloads.sourceforge.net       CNAME   sourceforge.net
sourceforge.net         A       66.35.250.203

> | This would be easier if the m5sum function I sent earlier today was
> | in octave :-) 
>
> It's fine with me if you add that.  My only question is whether
> md5.{h,c} files are the best to use, mostly from a licensing point of
> view.  Are there any implementations available that are GPL?
>   
I went to the source and took the sample implementation of the RSA
themselves, also the license seems to be GPL compatible to me. However,
we could always take the code from the gnu coreutils themselves. Note
that md5.{c,h} in the coreutils are autogenerated in recent versions,
and the last non autogenerated versions are available at

http://cvs.savannah.gnu.org/viewcvs/coreutils/lib/Attic/md5.h?root=coreutils&rev=1.21&hideattic=0&view=markup
http://cvs.savannah.gnu.org/viewcvs/coreutils/lib/Attic/md5.c?root=coreutils&rev=1.28&hideattic=0&view=markup

A reason to reject either of the above versions however is that a native
C++ implementation might be nicer. However, I failed to find one ready
made in C++. Even python uses C code, as can be seen in

http://svn.python.org/view/python/trunk/Modules/md5.c?rev=45465&view=auto

Perhaps the best starting point for a C++ implementation is the
gnu-crypto library Java implementation of MD5 at

http://cvs.savannah.gnu.org/viewcvs/gnu-crypto/source/gnu/crypto/hash/MD5.java?rev=1.7&root=gnu-crypto&view=auto

John, can state whether you want a C++ implementation of MD5 and if a C
implementation is ok, can you pick one of the above implementations?

Regards
David




> jwe
>
>   


-- 
David Bateman                                address@hidden
Motorola Labs - Paris                        +33 1 69 35 48 04 (Ph) 
Parc Les Algorithmes, Commune de St Aubin    +33 6 72 01 06 33 (Mob) 
91193 Gif-Sur-Yvette FRANCE                  +33 1 69 35 77 01 (Fax) 

The information contained in this communication has been classified as: 

[x] General Business Information 
[ ] Motorola Internal Use Only 
[ ] Motorola Confidential Proprietary