[UkOpenBSDUsers] 6.8 sha256

[Sivan !]

Hello

The instruction to verify sha256 of install68.img indicates that the
checksum file is part of the install68.img, there was no separate
checksum file to be downloaded for comparing the value of the
downloaded file, unless I am missing something.

The sha256 compare command did not work. However I computed the value as below:

14ea602583030b33e91ee8fde8dd76113984e9fac6598f9f609f408137c4cff2 install68.img

Is this correct, is the downloaded file clean please?

Thank you
_______________________________________________
Uk-OpenBSD-Users mailing list
Uk-OpenB...@saneusergroup.org.uk
http://ukopenbsdusers.saneusergroup.org.uk/mailman/listinfo/uk-openbsd-users
UK BSD Groups http://www.bsdgroups.org.uk/

[Stuart Henderson]

On 2021/02/13 21:17, Sivan ! wrote:
> Hello
>
> The instruction to verify sha256 of install68.img indicates that the
> checksum file is part of the install68.img, there was no separate
> checksum file to be downloaded for comparing the value of the
> downloaded file, unless I am missing something.

If you are just concerned with checking for download corruption, see the
SHA256 file in the same directory where you found install68.img.

There's also SHA256.sig which signed using "signify". This is part of
the OpenBSD base system but also builds easily on other OS. One OpenBSD
release includes the public key for the next release, so that once you
are already using a trusted version there's an ongoing chain for updates.
(This is checked automatically when you use "sysupgrade" to upgrade).

Keys are also published on the release page e.g.
https://www.openbsd.org/68.html - you will also find them in mailing
list posts announcing releases (so you can verify against multiple list
archives), and just searching for the key you should find it on a number
of websites.

> The sha256 compare command did not work. However I computed the value as below:
>
> 14ea602583030b33e91ee8fde8dd76113984e9fac6598f9f609f408137c4cff2 install68.img
>
> Is this correct, is the downloaded file clean please?

That matches the hash in the SHA256.sig file that I have downloaded and
checked against the 6.8 key.

[Sivan !]

Dear Stuart Henderson,

Thank you :) I waited to verify the integrity of the file before
starting the installer, it is very helpful that you have confirmed
that the signature matches. ( however I looked the signature file is
NOT there in the same directory as install68.img, your confirmation
is more than enough for me to go ahead )

Thank you.

[Stuart Henderson]

On 2021/02/13 22:00, Sivan ! wrote:
> Dear Stuart Henderson,
>
> Thank you :) I waited to verify the integrity of the file before
> starting the installer, it is very helpful that you have confirmed
> that the signature matches. ( however I looked the signature file is
> NOT there in the same directory as install68.img, your confirmation
> is more than enough for me to go ahead )

It should be; if you notice that one of the official mirrors listed on
www.openbsd.org/ftp.html doesn't have it, please let me know which one.

$ curl -s https://ftp.fr.openbsd.org/pub/OpenBSD/6.8/amd64/ | grep -e SHA -e install
<a href="SHA256">SHA256</a> 05-Oct-2020 03:00 1992
<a href="SHA256.sig">SHA256.sig</a> 05-Oct-2020 03:01 2144
<a href="install68.img">install68.img</a> 05-Oct-2020 02:50 696745984
<a href="install68.iso">install68.iso</a> 05-Oct-2020 02:50 535881728

[Sivan !]

Dear Stuart,

Thank you. I had alreday followed the download link for amd64 img from
OpenBSD.org/faq/faq4.html#Download. The sha256 verification commands didn't
work for install68.img and the signature wasn't there in the download
directory.

For installation I followed instructions from
ftp.openbsd.org/pub/OpenBSD/6.8/amd64/INSTALL.amd64, now I am on a tweaked
gnome3, OpenBSD works splendidly well as a workstation, some fixes to be
done, will request more help as I go.

Thank you :)