Subject: Very hard to find MD5 checksum of Debian CDs!

From: Shervin Emami <[email-masked]>
Date: Sun, 18 Sep 2016 09:33:31 +1000

Hi,

I've been using Debian for about 6 years now, but today I went to download
Debian Jessie from the "debian.org" website and realized there doesn't seem
to be any link on any of the pages to show what the MD5 checksum is of the
Debian installation CDs! I looked through many of the official Debian
webpages about downloading ISOs that all talk about verifying your MD5sum
but they don't show what the correct checksums are! I eventually found the
link on a StackExchange page, and even when searching the URL on Google, it
doesn't show up on the debian site at all! (
http://lmgtfy.com/?q=%22http%3A%2F%2Fcdimage.debian.org%2Fdebian-cd%2Fcurrent%2Famd64%2Fiso-cd%2FMD5SUMS%22).
Several people have posted the URL on this mailing list in previous years,
but surely there's a more beginner-friendly way, such as posting a link to
the MD5SUMS file right next to the links to download the ISO files.

Am I just not noticing the obvious link, or does the Debian website really
not give the info about how to verify checksums?

Cheers,
Shervin Emami.
http://www.shervinemami.info/Robotics_Engineer.html

---

From: "der.hans" <[email-masked]>
Date: Sun, 18 Sep 2016 00:39:48 +0000 (UTC)

Am 18. Sep, 2016 schwätzte Shervin Emami so:

moin moin Shervin,

Which specific ISO were you downloading? Where did you get the link to the
image?

The main download site does have checksum files right alongside the ISO
images.

http://cdimage.debian.org/debian-cd/8.5.0/amd64/iso-cd/

http://cdimage.debian.org/debian-cd/8.5.0/amd64/iso-cd/MD5SUMS

http://cdimage.debian.org/debian-cd/8.5.0/amd64/iso-cd/debian-8.5.0-amd64-CD-1.iso

The BitTorrent page also shows various checksums.

BTW, if you want to verify the image, then use the sha512 checksums
instead as md5 is not cryptographically secure. Also verify the gpg
signatures.

I notice the network install page for small CDs links directly to the ISOs
rather than to the download directory. The checksums are in the directory
that holds the ISOs.

https://www.debian.org/distrib/netinst#smallcd

http://cdimage.debian.org/debian-cd/8.5.0/amd64/iso-cd/debian-8.5.0-amd64-netinst.iso

I'm not certain what the tiny CDs and network boot sections are linking
to, but there are at least checksum files.

ciao,

der.hans

-- 
#  http://www.LuftHans.com/        http://www.PhxLinux.org/
#  Two roads diverged in a wood, and I --
#  I took the one less traveled by,
#  And that has made all the difference. -- Robert Frost
#  I, OTOH, prefer to just go stomping through the desert... - der.hans

---

From: Shervin Emami <[email-masked]>
Date: Sun, 18 Sep 2016 11:05:42 +1000

At "www.debian.org" I clicked on "Getting Debian", and then to get a net
install image there are 3 different pages that all have direct links to the
ISO files, but no link at all about how to get the MD5sums. Even the Verify
page doesn't show how to find the MD5sums. So I think it will help many
users if there can be a link to the MD5sum file at these 4 pages:

    https://www.debian.org/distrib/
    https://www.debian.org/distrib/netinst
    https://www.debian.org/CD/netinst/
    https://www.debian.org/CD/verify

I was looking for amd64 netinstall but it seems the problem exists for all
architectures and both for netinstall or CD. So adding a few links could
help quite a few beginners!

Cheers,
Shervin Emami.

On Sun, Sep 18, 2016 at 10:39 AM, der.hans <[email-masked]> wrote:

>> http://lmgtfy.com/?q=%22http%3A%2F%2Fcdimage.debian.org%2Fde
>> bian-cd%2Fcurrent%2Famd64%2Fiso-cd%2FMD5SUMS%22).

---

From: Lisi Reisz <[email-masked]>
Date: Sun, 18 Sep 2016 12:42:02 +0100

> help quite a few beginners!

Not just beginners.  I too find it a nightmare, and sometimes give up.  If you 
look at the raw HTML you can extract the URL of the download directory and 
they are indeed there - it is finding the directory which is hard, because 
the link just says "click here" or something, and if you click it immediately 
begins downloading.  You never see the directory.

One of the developers has raised this as a bug.

Lisi
> > Which specific ISO were you downloading? Where did you get the link to
> > the image?
> >
> > I notice the network install page for small CDs links directly to the
> > ISOs rather than to the download directory. The checksums are in the
> > directory that holds the ISOs.
> >
> >> I've been using Debian for about 6 years now, but today I went to
> >> download Debian Jessie from the "debian.org" website and realized there
> >> doesn't seem
> >> to be any link on any of the pages to show what the MD5 checksum is of
> >> the Debian installation CDs! I looked through many of the official
> >> Debian webpages about downloading ISOs that all talk about verifying
> >> your MD5sum but they don't show what the correct checksums are! I
> >> eventually found the link on a StackExchange page, and even when
> >> searching the URL on Google, it
> >> Several people have posted the URL on this mailing list in previous
> >> years, but surely there's a more beginner-friendly way, such as posting
> >> a link to the MD5SUMS file right next to the links to download the ISO
> >> files.
> >>
> >> Am I just not noticing the obvious link, or does the Debian website
> >> really not give the info about how to verify checksums?
> >>
> >> Cheers,
> >> Shervin Emami.

---

From: [email-masked]
Date: Sun, 18 Sep 2016 17:18:39 +0000 (UTC)

> One of the developers has raised this as a bug.

Four things:

1. Can anyone provide a link to this bug report?

2. If you view page source to figure out what url a link points to, I
suspect that either 1) you find page source inherently fascinating, or
2) your browser does not provide an easier method for obtaining that
information.

A web browser without a status line that displays the url pointed to
by the current link is like a car with an opaque windscreen. IMHO.

Firefox does not lack this feature. Neither does lynx (though lynx
must be set to "advanced" mode to enable it).

Are you sure your browser does not have a similar feature that can be
enabled?

3. What web browser does not enable editing the current link?

In firefox, one can right-click on a link, select "Copy link location"
from a menu, and then paste the link into the location bar for
editing. It is easier in lynx, where one simply hits 'E' (or whatever
key is bound to the command :ELGOTO) to edit a link.

4. This thread prompted me look up how one can contribute to debian's
web pages. It looks like interested parties can begin here:

  "Helping with the Debian web pages"
  https://www.debian.org/devel/website/

-- 
# Orpheus - Wikipedia, the free encyclopedia

   Orpheus had a brother named Linus who went to Thebes and became a
   Theban. He is claimed by Aristophanes and Horace to have taught
   cannibals to subsist on fruit, and to have made lions and tigers
   obedient to him. Horace believed however, that Orpheus only
   introduced order and civilization to savages.

---

From: [email-masked]
Date: Sun, 18 Sep 2016 19:19:34 +0000 (UTC)

TLDR: links to pertinent bug reports:

#381555 - http://www.debian.org/CD/netinst/ : add link to iso md5 cheksum
  bugs.debian.org/cgi-bin/bugreport.cgi?bug=381555

#640054 - Download pages should have prominent links to image verification instructions
  bugs.debian.org/cgi-bin/bugreport.cgi?bug=640054

#612116 - www.debian.org: /CD/ should now redirect to the new /distrib/
  bugs.debian.org/cgi-bin/bugreport.cgi?bug=612116

> 1. Can anyone provide a link to this bug report?

Having done some browsing at

  bugs.debian.org/cgi-bin/pkgreport.cgi?pkg=www.debian.org

the following three bug reports all pertain to this thread, one way or
another:

#381555 - http://www.debian.org/CD/netinst/ : add link to iso md5 cheksum
  bugs.debian.org/cgi-bin/bugreport.cgi?bug=381555

#640054 - Download pages should have prominent links to image verification instructions
  bugs.debian.org/cgi-bin/bugreport.cgi?bug=640054

#612116 - www.debian.org: /CD/ should now redirect to the new /distrib/
  bugs.debian.org/cgi-bin/bugreport.cgi?bug=612116

My guess is that the first of these is what Lisi referred to.

Interestingly, if I am reading the thread under #381555 correctly*,
three years ago someone submitted a patch for the page located here

  www.debian.org/CD/netinst

that addressed the issue of where to find checksums associated with
the linked iso files,

  bugs.debian.org/cgi-bin/bugreport.cgi?bug=381555#17

but the patch, as submitted, required some edits,

  bugs.debian.org/cgi-bin/bugreport.cgi?bug=381555#24

and AFAICT the page that was to be patched (namely, CD/netinst)
remains unpatched. (So, I guess, the patch slipped through a
do-acratic crack and never got edited?)

Currently that same CD/netinst page does link to the CD FAQ (so
called). And that FAQ page, in turn, contains an answer

  www.debian.org/CD/faq/#verify

which someone encountering the OP's difficulty would likely consult.

Unfortunately that particular answer also fails to provide hints about
where to obtain the appropriate checksum files.

* Bug threads being a genre that taxes my reading comprehension, for
   some reason.

-- 
NetHack advises:
> Talking to yourself is a bad habit for a dungeoneer.

---

From: Richard Owlett <[email-masked]>
Date: Sun, 18 Sep 2016 13:43:26 -0500

> 1. Can anyone provide a link to this bug report?

*VERY IMPORTANT* !

>
> 2. If you view page source to figure out what url a link points
> to, I suspect that either
>   1) you find page source inherently  fascinating,

I am not Lisi, but I find that OFFENSIVE!

>  or

Who is target audience of the link?
   1. some GEEK
   2. Some John/Jane Q. Public who has *HEARD* that Linux > Windows?

> Are you sure your browser does not have a similar feature that

SEE question above.

> key is bound to the command :ELGOTO) to edit a link.

SEE above.

>
> 4. This thread prompted me look up how one can contribute to
> Debian's

Did you know Debian has a "wiki".

---

From: Lisi Reisz <[email-masked]>
Date: Sun, 18 Sep 2016 22:34:24 +0100

> > 1. Can anyone provide a link to this bug report?

Here is the discussion in the final email of the relevant discussion (with 
interleaved quotations!) which includes a reference to the bug report which I 
mentioned.

https://lists.debian.org/debian-user/2016/03/msg01297.html

The bug report is:
http://bugs.debian.org/819664

Lisi

---

From: Richard Owlett <[email-masked]>
Date: Mon, 19 Sep 2016 05:37:29 -0500

> On Sunday 18 September 2016 19:43:26 Richard Owlett wrote:
[snip]
> http://bugs.debian.org/819664

Thank you. I like the form that seems to be evolving.

---

From: [email-masked]
Date: Sun, 18 Sep 2016 20:46:52 +0000 (UTC)

> I am not Lisi, but I find that OFFENSIVE!

In my book, if what you read is always inoffensive then you are not
much of a reader.

It appears that I have managed to promote literacy without even
trying.

>  2. Some John/Jane Q. Public who has *HEARD* that Linux > Windows?

I imagine the audience is some category that includes both (1) and
(2).

Quantitatively, I expect that the 2s significantly outnumber the 1s.

I confess that I suspect your question was rhetorical, that it was
meant to assert (2) as the correct answer, and that it is possible I
don't understand the point you are making here.

I halfway suspect that you have, somehow, read a different message
than the one I intended to write. Either that, or you are making a
joke, and it is one that has flown over my head. (If the latter case,
there is no need to explain the joke. Do not spoil anything, on my
behalf, for people with a better sense of humor.)

>> Are you sure your browser does not have a similar feature that

Hrm. Are we on the same page?

I intended to 1) register my surprise that Lisi searches through page
source to find the url associated with a given link, and 2) mention
the existence of other ways to find (and use) that url, for the
possible benefit of whoever might have been unaware.

Casting about in the darkness, in case it was unclear to anybody: the
reason for my remarks about browser features was not to cast blame on
John/Jane Q. Public for difficulties they encounter should they fail
to use a web browser whose feature-set I have personally approved.

Also, if we are taking votes on whether the web site can be improved,
please mark me down as a "Yea".

Pop quiz!

Q: Is this what I meant? "Can't see what location this link points to?
HAR HAR! Get a better browser, you dummy!"

A: No.

> Did you know Debian has a "wiki".

This looks like another rhetorical question, whose apparent content I
might have thought both uncontroversial and unremarkable, and whose
pertinence and intent is unclear to me.

I must seem very obtuse.

-- 
   Elly May, this is Wiggy and Shaky, and that's Horace, the great
   poet, thinker, and philosopher.

The Beverly Hillbillies - season 3 episode 27 "Big Daddy Jed"
http://mreplay.com/transcript/the_beverly_hillbillies-(big_daddy,_jed)/4692/TVLANDP/Wednesday_October_15_2014/762166/

---

From: "Andrew M.A. Cater" <[email-masked]>
Date: Sun, 18 Sep 2016 19:26:59 +0000

> >>>help quite a few beginners!
For example:

has a full list of MD5 sums and all other hashes at the top level
- and the signed hashes of those.

www.debian.org/CD/verify explicitly mentions this.

May I suggest lmgtfy.com ? [Other, equally good and useful search
engines are also available at other web locations.]

"Debian CD md5 sum" gives you these as the first two links if you
look for them.

Hope this helps,

All the very best,

Andy C

---

From: Francesco Ariis <[email-masked]>
Date: Sun, 18 Sep 2016 22:06:51 +0200

> "Debian CD md5 sum" gives you these as the first two links if you

OP is not complaining that they are not there, but that from the
site they are not well advertised/difficult to reach.

"Debian the universal operating system with plenty of
passive-aggressive people" doesn't make a good slogan.

---

From: [email-masked]
Date: Sun, 18 Sep 2016 17:29:20 +0000 (UTC)

Clarifying edits ("link" => "link's url") in square brackets, below.

On Sun, 18 Sep 2016, [email-masked] meant to write:
> 3. What web browser does not enable editing the current link['s url]?
>
> from a menu, and then paste the link['s url] into the location bar for
> key is bound to the command :ELGOTO) to edit a link['s url].

---

From: Ben Caradoc-Davies <[email-masked]>
Date: Sun, 18 Sep 2016 12:29:06 +1200

> not give the info about how to verify checksums?

Shervin, it seemed obvious to me. The checksum files are at the top of 
the download directory listing [1].

Starting at <https://www.debian.org/>, I clicked on "Getting Debian / 
CD/USB ISO images". This took me to the "Debian on CDs" page 
<https://www.debian.org/CD/>. From this page, I could navigate to 
"Download CD/DVD images using HTTP or FTP" / "Official CD/DVD images of 
the "stable" release" / "amd64", which contains the ISO images, 
checksums, and signatures (scroll to the top):
<http://cdimage.debian.org/debian-cd/8.5.0/amd64/iso-cd/>

The "Debian on CDs" page also has a link "Verifying authenticity of 
Debian CDs" <https://www.debian.org/CD/verify> which describes how to 
verify the signed checksums (but does not provide a command line 
example; this could be improved).

[1] At the top of the listing because they are in ALL CAPS and capital 
letters are first in the "C" collating order. This is why you often see 
README.txt not readme.txt, for example.

Kind regards,

-- 
Ben Caradoc-Davies <[email-masked]>
Director
Transient Software Limited <http://transient.nz/>
New Zealand