Mailing List Archive

Alpha Tester <r3flex@yahoo.com> writes:

> I've searched through gnupg's site, and I still
> haven't found the official checksum that corresponds
> to the gpg-1.0.0 version that I downloaded, and I

$ md5sum gnupg-1.0.0.tar.gz
bba45febd501acf8e19db402506dae94 gnupg-1.0.0.tar.gz

But wait a few days, so others can verify the sum and complain if
there is a problem with this message.

I don't sign it, because it does not help you and the Web Archiver
for the ML cannot handle MIME signed mails properly.


Werner


--
Werner Koch at guug.de www.gnupg.org keyid 621CC013

Werner Koch wrote:
>
> Alpha Tester <r3flex@yahoo.com> writes:
>
> > I've searched through gnupg's site, and I still
> > haven't found the official checksum that corresponds
> > to the gpg-1.0.0 version that I downloaded, and I
>
> $ md5sum gnupg-1.0.0.tar.gz
> bba45febd501acf8e19db402506dae94 gnupg-1.0.0.tar.gz
>

Here's mine:
bba45febd501acf8e19db402506dae94 gnupg-1.0.0.tar.gz

I was going to post this same question today, you've saved me the
trouble. :-)

Looks good to me.

Werner Koch wrote:
>
> Alpha Tester <r3flex@yahoo.com> writes:
>
> > I've searched through gnupg's site, and I still
> > haven't found the official checksum that corresponds
> > to the gpg-1.0.0 version that I downloaded, and I
>
> $ md5sum gnupg-1.0.0.tar.gz
> bba45febd501acf8e19db402506dae94 gnupg-1.0.0.tar.gz
>
> But wait a few days, so others can verify the sum and complain if
> there is a problem with this message.
>
> I don't sign it, because it does not help you and the Web Archiver
> for the ML cannot handle MIME signed mails properly.
>
> Werner
>
> --
> Werner Koch at guug.de www.gnupg.org keyid 621CC013

Hello,
I am extrememly grateful for you to provide gpg.
It runs well and fixes a whole bunch of problems
that we had with pgp.

Now comes the question ot trust. I compiled my own, but didn't
check the source code. ( What good would it do me?; I'm not advanced
enough
at C to recognize a backdoor if I saw it. :-) ).

So I needed the md5sum check to validate my version and I see
2 trust problems. I am sure there are more, but I am ignorant of them.
I was thinking about this all day.

The first is:
Are there any rumors of backdoors in gpg?
I mean the md5sum is correct, but what is the integrity
of gnupg.org? Is there an code oversight committee to check
releases for backdoors?
I hope that GnuPG isn't financed by Interpol.;-) Not that
governmental security agencies are not good institutions,
but I don't want them controlling encryption code. They can spy
in other ways to get info on you. Of course I am not even suggesting
this is true. It is a trust issue, and I am wise about the
Machiavellian world.

The second is:
How do I know that the email is not being spoon-fed to me?
I mean Werner could have posted email with the correct md5sum
of his copy, and someone on my server, (or along the route), could
edit his email to match the md5sum of the bogus copy that they switched
on me
when I downloaded. Thereby I would be fooled into thinking that I had
confirmation from Werner about the validity of the download.
I find it worrisome that Werner didn't sign the md5sum file.
Signing was the first thing explained in the Readme.
Would you be kind enough to sign the md5sum file with ascii
armor and put it on the mail list? I mean it is ascii armored
so we could receive it thru email. It would only be a few k.
I don't understand why your mailer can't handle ascii armored files?
Also, why wouldn't it help us, it would say that it came from your
machine.
At least that is what the docs say.

At the very least it will be good practice for all us newbies, and
makes us think about it all more deeply.


Am I being overly paranoid here? I mean there are alot of agents with
computers out there
and alot of money goes into surveillance. Why not keep REAL crypto from
the average citizen?
And......how do we know that the people who run the newtworks are not
playing games with us?

zentara ....crypto newbie

--- Werner Koch <wk@gnupg.org> wrote:
> Alpha Tester <r3flex@yahoo.com> writes:
>
> > I've searched through gnupg's site, and I still
> > haven't found the official checksum that corresponds
> > to the gpg-1.0.0 version that I downloaded, and I
>
> $ md5sum gnupg-1.0.0.tar.gz
> bba45febd501acf8e19db402506dae94 gnupg-1.0.0.tar.gz
>
> But wait a few days, so others can verify the sum and complain if
> there is a problem with this message.

Thanks! It's a perfect match.. though it would be nice would if
some other people verifed the sum... (hint, hint) ;-)

-Jay

=====

__________________________________________________
Do You Yahoo!?
Bid and sell for free at http://auctions.yahoo.com

On Thu, 28 Oct 1999, Alpha Tester wrote:

> > $ md5sum gnupg-1.0.0.tar.gz
> > bba45febd501acf8e19db402506dae94 gnupg-1.0.0.tar.gz
> >
> > But wait a few days, so others can verify the sum and complain if
> > there is a problem with this message.
>
> Thanks! It's a perfect match.. though it would be nice would if
> some other people verifed the sum... (hint, hint) ;-)

Because you asked, here is the md5sum of my GnuPG-1.0 copy:

bba45febd501acf8e19db402506dae94 gnupg-1.0.0.tar.gz

As you can see, it's the same.


cu
Michael

Thanks for the replies, everyone! :)


--- "L. Sassaman" <rabbi@quickie.net> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Tue, 26 Oct 1999, Werner Koch wrote:
>
> > Alpha Tester <r3flex@yahoo.com> writes:
> >
> > > I've searched through gnupg's site, and I still
> > > haven't found the official checksum that corresponds
> > > to the gpg-1.0.0 version that I downloaded, and I
> >
> > $ md5sum gnupg-1.0.0.tar.gz
> > bba45febd501acf8e19db402506dae94 gnupg-1.0.0.tar.gz
> >
> > But wait a few days, so others can verify the sum and complain if
> > there is a problem with this message.
> >
> > I don't sign it, because it does not help you and the Web Archiver
> > for the ML cannot handle MIME signed mails properly.
>
> thetis:rabbi:~/src/pgp$ md5sum gnupg-1.0.0.tar.gz
> bba45febd501acf8e19db402506dae94 gnupg-1.0.0.tar.gz
>
> Is what I got... so I'd say that's right. :)
>
> __
>
> L. Sassaman
>
> System Administrator | "Don't ever tell anybody anything.
> Technology Consultant | anything. If you do, you start
> icq.. 10735603 | missing everybody."
> pgp.. finger://ns.quickie.net/rabbi | --J.D. Salinger
>
>
>
>
>
>
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.0.0 (GNU/Linux)
> Comment: OpenPGP Encrypted Email Preferred.
>
> iD8DBQE4H2shPYrxsgmsCmoRAn81AJ90rn+nkZjYa0uwltvXTiRIxk0HlgCgm/Ag
> ImvjpCb2GrG5Cq78oZNIhSg=
> =+qbR
> -----END PGP SIGNATURE-----
>
>


=====

__________________________________________________
Do You Yahoo!?
Bid and sell for free at http://auctions.yahoo.com