Hello,

A question about GnomeSlackBuild repositories. For instance, about this mirror:

http://mirror.switch.ch/ftp/mirror/g...are-13.37/gsb/

It seems the file CHECKSUMS.md5 is corrupted. slapt-get --update shows that, anyway, although the signature is good (however expired). But it is not real corrupted, in fact, as I'll try to demonstrate next.

What seems to be happening is that the file format isn't properly recognized by md5sum -c, for instance (and probably by slapt-get as well).

The checksums file has some lines of header and a list of lines such as "<hash> <filename>". Both items are separated by two spaces. If I edit that file and cut one space off, "md5sum -c" begins to work as desired.

A similar effect can be seen if the header is stripped off the file.

Anyway, the final result is that slapt-get gets unuseful in this case.

My two questions are: (1) is there anybody there who saw this as myself (that is, is there any mistake in my findings, or is there any other GSB user out there)?, and (2) how to manage this in order to restore service, in case of (1) being true.

Thanks,

Luiz Ramos
São Paulo - Brazil

Yeah there's been people posting recently on various forums when trying to install GSB that it's broken.

This issue was first discussed here.

The problem is that lines that are not md5 checksums need to be properly commented with a "#".

The gsb checksums.md5 file as well as the slackware checksums.md5 file are not doing this.

Even though "md5sum" supports this since 2005.

Like that really matters at all.

The fact is, people are posting that installation of GSB is broken, there's no clues there for users to correct the issue, and therefore people are posting such.

Hello,

I found some more information. slapt-get doesn't seem to use md5sum as I thought first (and it's not a script). But it checks carefully the signature of CHECKSUMS.md5 with CHECKSUMS.md5.asc, and detects properly that the key is expired. What it doesn't do that perfect is to show it for the user... the message "not verified" spans to a couple of reasons, including "key expired".

So,

- md5sum is okay
- slapt-get is okay
- the file CHECKSUMS.md5 from GSB should be signed again with a valid signature
- slapt-get complains about that expired key from GSB and the signature released with that key

This solves the questions proposed in my first post. I would also suggest slapt-get could be more precise when showing the reason for the "not verified" status of the signature; I prepared mysqlf a first patch to do it, but this may break "apt-get" similarity, and for this reason I am not confident it would be accepted without discussion.

Thanks,

Luiz