Posted May 10, 2018
The linux installer scripts only compute the md5 of the initial part of the script, up to the size defined by the filesizes variable. The filesizes variable is insufficient to cover the entire file in every installer script I've looked at so far. This can be easily tested by modifying the last line of a file and running the --check feature, which will succeed in spite of having a corrupt file.
The obvious case where this is an issue is in large downloads that fail partway through, as only a small initial portion of the file is ever verified.
Bonus Question: Are complete checksums posted somewhere to manually verify the downloads?
The obvious case where this is an issue is in large downloads that fail partway through, as only a small initial portion of the file is ever verified.
Bonus Question: Are complete checksums posted somewhere to manually verify the downloads?
