On Thu, Feb 23, 2012 at 02:30:35PM +0200, Zeeshan Ali (Khattak) wrote: > > Didn't think of these but yeah, sounds good except that I think we > could do with just one checksum element per ISO: > > <checksum url="http:/...."/>XXXXXX</checksum> > > where "XXXXXX" code could just be "" if url is provided. Then we can > also add an attribute for md5 of first 1MiB: > > > <checksum url="http:/...." first-5-mib="YYYYY">XXXXXX</checksum> > > Open to suggestion about better name for 'first-5-mib' here. first-1-mib which would more accurately reflect reality? :) Maybe just "partial-md5" or "fast-md5" and document that it's 1MB only? Another thought, do we want to restrict ourselves to md5? Given the various md5sum collision issues, I wouldn't want people to rely on libosinfo to check the md5 of an ISO and then have these people assume they are guaranteed that the ISO is the one they think it is because libosinfo "authenticated" it. Christophe
Attachment:
pgpJ3zftQn45H.pgp
Description: PGP signature
