I am preparing upgrade to KDE 2.2.2 from KDE 2.1.1. I had to download of lot of dependencies to get it to work. So I went the easy way and searched on www.rpmfind.net for all the dependencies and downloaded them all with the corresponding web pages.

I put all the downloaded dependencies into one directory and typed:

md5sum *.*

Then I compared the MD5sums mention at the shell to the corresponding webpages with the MD5sum's mentioned on them.

Then I found that none of them matched.

Should I worry about this and where can I find a similar place on the net with MD5sums/signatures files and .RPMs.

BTW: My distro is Mandrake 8.0

Thanks

Well, there's a few possibilities me thinks, sure I haven't got em all but here's a few:
1. your box was compromised and your md5sum binary was hacked (very unlikely)
2. the rpmfind.net ftp server has been hacked, and some l33t oaf replaced the package (somewhat unlikely)
3. the package changed minor version and they didn't update the checksum (the system is automated, but snafu's are always possible)
4. the download went wrong because you used a browser instead of something like ftp or wget and so the checksum ain't the same (common)

I tried it myself using Nutscrape and wget, and both times the md5sum failed, so IMO 4 is ruled out, so I'm thinking 3, which is damn bad.

I'd look for a Mandrake ftp mirror if you want to be sure.

I've found a few Mandrake mirrors around, but none that I've looked at have a list of thier MD5sums. Any anyone know where I can get source dependencies for KDE 2.2.2.