MD5 checksum mismatch for the DVD image metalink files

Bug #468778 reported by Till Ulen
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Ubuntu CD Images
New
Undecided
Unassigned
Ubuntu
Confirmed
High
Kate Stewart
Lucid
Won't Fix
High
Kate Stewart
Precise
Won't Fix
High
Kate Stewart

Bug Description

I've downloaded three files from http://cdimage.ubuntu.com/releases/9.10/release/ : ubuntu-9.10-dvd-i386.metalink, MD5SUMS-metalink and MD5SUMS-metalink.gpg. I have verified the signature for MD5SUMS-metalink in the .gpg file. But the MD5 hash for the ubuntu-9.10-dvd-i386.metalink file that is listed in MD5SUMS-metalink does not match the actual MD5 hash of the metalink file I have.

$ grep i386 MD5SUMS-metalink
b4fd8f60865e39983fab713d45a0fc29 ubuntu-9.10-dvd-i386.metalink
$ md5sum ubuntu-9.10-dvd-i386.metalink
1d449c6e6313ecc239d9e9c8f828b435 ubuntu-9.10-dvd-i386.metalink

Is this a problem with my download or with the release script that generated MD5SUMS-metalink? Are you able to reproduce this?

Problematic metalink file attached.

Revision history for this message
Till Ulen (tillulen) wrote :
Revision history for this message
shaozuozhen (shaozuozhen) wrote :

Hello Alexander,

I encountered the same issue, but finally I found it isn't a bug. The root cause is that the software which I used to create MD5-value is not so good. After that I turned to other software (Cygwin and md5summer), then I got what I want. The MD5SUM is identical with the file from http://cdimage.ubuntu.com/releases/9.10/release/

So I suggest you to try for this.

Best Regards
Zuozhen Shao

Revision history for this message
Till Ulen (tillulen) wrote :

I do not understand. Are you saying that there must be bug in the stock /usr/bin/md5sum in Ubuntu 8.04, which I used?

I don't have neither Windows nor Cygwin, and there seems to be no md5summer package for Ubuntu. Were you verifying the checksum for the ubuntu-9.10-dvd-i386.metalink file or perhaps some other file? Could you please attach your copy of ubuntu-9.10-dvd-i386.metalink and copy its MD5 checksum here (as calculated by your tools, Cygwin and md5summer)?

Revision history for this message
Till Ulen (tillulen) wrote :

I can reproduce this for Ubuntu 10.04 beta 2 live DVD. Files downloaded from:
http://cdimage.ubuntu.com/releases/10.04/beta-2/MD5SUMS-metalink
http://cdimage.ubuntu.com/releases/10.04/beta-2/ubuntu-10.04-beta2-dvd-i386.metalink
http://cdimage.ubuntu.com/releases/10.04/beta-2/ubuntu-10.04-beta2-dvd-amd64.metalink

$ md5sum -c MD5SUMS-metalink
ubuntu-10.04-beta2-dvd-amd64.metalink: FAILED
ubuntu-10.04-beta2-dvd-i386.metalink: FAILED
md5sum: WARNING: 2 of 2 computed checksums did NOT match
$ md5sum *.metalink
6753adc606bb5d87615dacd669a01f0e ubuntu-10.04-beta2-dvd-amd64.metalink
1cbfc61e0560a5b3ef5b12b61d9f2877 ubuntu-10.04-beta2-dvd-i386.metalink

My copies of the files attached. Downloaded using Firefox 3.0 from Ubuntu 8.04.

summary: - MD5 checksum mismatch for the 9.10 (Karmic) i386 DVD image metalink file
+ MD5 checksum mismatch for the DVD image metalink files
Revision history for this message
Fabio Marconi (fabiomarconi) wrote :

Hello
Is this problem present with the latest Lucid's or Maverick's images?
Thanks in advance
Fabio

Changed in ubuntu:
status: New → Incomplete
Revision history for this message
Fabio Marconi (fabiomarconi) wrote :

We are closing this bug report because it lacks the information we need to investigate the problem, as described in the previous comments. Please reopen it if you can give us the missing information, and don't hesitate to submit bug reports in the future. To reopen the bug report you can click on the current status, under the Status column, and change the Status back to "New". Thanks again!

Changed in ubuntu:
status: Incomplete → Invalid
Till Ulen (tillulen)
Changed in ubuntu:
status: Invalid → New
Revision history for this message
Till Ulen (tillulen) wrote :

This occurs again for Ubuntu 11.10 and possibly previous versions (I only tested 11.10). The GPG signature is OK, but all MD5 hashes don't match the corresponding .metalink files.

Problematic files attached. All were downloaded from the http://cdimage.ubuntu.com/releases/11.10/release/ directory. The downloads were verified by using different clients (Firefox and wget), different mirrors (cdimage.ubuntu.com and mirror.yandex.ru) and an SSL anonymous proxy, so this is not a problem on my side.

Revision history for this message
Matt Fischer (mfisch) wrote :

I can confirm that the sums do indeed look bad. I tried running metalink manually here and all the resulting sums look okay. This implies that these sums are not generated with metalink or are generated with a different version than I have. I will investigate further as time permits.

Matt Fischer (mfisch)
Changed in ubuntu:
status: New → Confirmed
Revision history for this message
Matt Fischer (mfisch) wrote :

I dug into this a bit more tonight and here is some additional info:

If you look at the sums from releases.ubuntu.com, they're all good:

mfisch@caprica:~/Downloads/releases.ubuntu.com/oneiric$ md5sum -c MD5SUMS-metalink.releases
ubuntu-11.10-alternate-amd64.metalink: OK
ubuntu-11.10-alternate-i386.metalink: OK
ubuntu-11.10-desktop-amd64.metalink: OK
ubuntu-11.10-desktop-i386.metalink: OK
ubuntu-11.10-server-amd64.metalink: OK
ubuntu-11.10-server-i386.metalink: OK

On the other hand, all the ones from cdimage.ubuntu.com are bad:
mfisch@caprica:~/Downloads/cdimage.ubuntu.com/releases/11.10/release$ md5sum -c MD5SUMS-metalink.txt
ubuntu-11.10-alternate-amd64+mac.metalink: FAILED
ubuntu-11.10-desktop-amd64+mac.metalink: FAILED
ubuntu-11.10-dvd-amd64.metalink: FAILED
ubuntu-11.10-dvd-i386.metalink: FAILED
md5sum: WARNING: 4 computed checksums did NOT match

If you look at the datestamps for the metalink files on cdimages you will see:
13-Oct-2011 10:48
The stamp from inside the file, which metalink generates for you, matches:
Thu, 13 Oct 2011 10:48:06

But the datestamp for the MD5SUMS-metalink file is:
13-Oct-2011 10:01

tags: added: rls-mgr-p-tracking
Revision history for this message
Rolf Leggewie (r0lf) wrote :

lucid has seen the end of its life and is no longer receiving any updates. Marking the lucid task for this ticket as "Won't Fix".

Revision history for this message
Steve Langasek (vorlon) wrote :

The Precise Pangolin has reached end of life, so this bug will not be fixed for that release

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.