#237: tests to verify that torrents and mirrors contain signed checksum files
----------------------+-----------------------------------------------------
Reporter: robatino | Owner:
Type: task | Status: new
Priority: major | Milestone:
Component: Wiki | Version:
Keywords: |
----------------------+-----------------------------------------------------
In many of the last several releases (11, 13, 14, and now 16), at least
some of the Alpha or Beta torrents contain only unsigned checksum files.
This would be easy to prevent by examining the .torrent files, which
contain file sizes (signing a checksum file adds about 1K to the size).
Unfortunately, at present these are not made available for testing prior
to being posted on http://torrent.fedoraproject.org , and when the problem
is pointed out, no matter how quickly, one is told that the torrent can't
be replaced since people are already downloading it. This makes it
important to catch the problem in advance.
Many (but not all) of the torrent files for the last several releases are
still available at http://torrent.fedoraproject.org/torrents/ and
http://torrent.fedoraproject.org/spins/ , and can be examined for example
with gtorrentviewer. I have not checked any older than 11, and not all the
ones after that are available, so the above list of affected releases is
probably incomplete.
A less serious issue is when the checksum files get signed more than once.
For example, the checksum files for F15 Final install discs were signed
twice, first for the torrents and again for the mirrors - see
http://robatino.fedorapeople.org/checksums/15-Final/Fedora/ . The
checksums are identical, and both signatures are valid, but still, it
shouldn't happen.
Looking at
https://fedoraproject.org/wiki/Release_Engineering_Release_Tickets , it
says that for Alpha and Beta, the torrents should be staged before the
mirrors, but the reverse for Final. I've asked why on #fedora-releng but
gotten no response yet. It says nothing about signing the checksum files,
though the linked page
https://fedoraproject.org/wiki/Stage_final_release_for_mirrors (under the
section "Final") mentions it. This may explain why Alpha and Beta torrents
are much less likely to have signed files. If possible, it would be nice
for the order (torrents vs. mirrors) to be the same for all three, and in
any case, the checksum files should be signed once and then used for both
torrents and mirrors. None of this is currently documented.
--
Ticket URL: <https://fedorahosted.org/fedora-qa/ticket/237>
Fedora QA <http://fedorahosted.org/fedora-qa>
Fedora Quality Assurance
--
test mailing list
test@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe:
https://admin.fedoraproject.org/mailman/listinfo/test
