<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div>On Feb 17, 2011, at 8:41 AM, Arnaud Quette wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">Hi John,<br><br><div class="gmail_quote">2011/1/17 John Bayly<br><blockquote class="gmail_quote" style="margin-top: 0pt; margin-right: 0pt; margin-bottom: 0pt; margin-left: 0.8ex; border-left-width: 1px; border-left-style: solid; border-left-color: rgb(204, 204, 204); padding-left: 1ex; position: static; z-index: auto; "><div class="im">On 14/01/2011 20:40, Arnaud Quette wrote:<br> </div><blockquote class="gmail_quote" style="margin-top: 0pt; margin-right: 0pt; margin-bottom: 0pt; margin-left: 0.8ex; border-left-width: 1px; border-left-style: solid; border-left-color: rgb(204, 204, 204); padding-left: 1ex; position: static; z-index: auto; "><div class="im"> Author: aquette<br> Date: Fri Jan 14 20:40:06 2011<br> New Revision: 2832<br> URL: <a href="http://trac.networkupstools.org/projects/nut/changeset/2832" target="_blank">http://trac.networkupstools.org/projects/nut/changeset/2832</a><br> <br></div><div class="im"> +link:<a href="http://www.networkupstools.org/source/2.6/nut-2.6.0.tar.gz.sig%5Bsignature%5D" target="_blank">http://www.networkupstools.org/source/2.6/nut-2.6.0.tar.gz.sig[signature]</a><br> </div></blockquote> May I suggest that you also provide checksums for the tarball? I'm updating the FreeBSD port, and wanted to verify the SHA256 sum. As it's been downloaded from the NUT website, I know the odds of the source being tainted are astronomical, but if it's for a distribution, I thought I'd be extra cautious.<br> As it is I've verified the GPG sig (never used it before) and used the computed SHA sum.<br></blockquote></div><br>I've added a SHA256 hash, and referenced it in the download section:<br><a href="http://www.networkupstools.org/download.html">http://www.networkupstools.org/download.html</a><br> <br>I've not yet updated the documentation, but it's simple as downloading the nut archive and the matching .sha256 file. Then using:<br>$ sha256sum -c nut-2.6.0.tar.gz.sha256<br clear="all"></blockquote></div><br><div>Arnaud,</div><div><br></div><div>I go through a similar set of steps for Fink packages. If there is a GPG signature, I'll verify that, since it provides a little more chain-of-trust information. However, if I am just downloading a single file, it is typically easier to just verify the hash by inspection - that is, with the SHA256 on the web page rather than a separate file download.</div><div><br></div><div>Also, there is a bit more of an audit trail if the hash is in our web pages in SVN.</div><div><br></div><div>Just my $0.02.</div><div><br></div><div>- Charles</div></body></html>