Comment 9 for bug 1277589

On Fri, Feb 07, 2014 at 07:49:27PM -0000, Barry Warsaw wrote:
> On Feb 07, 2014, at 07:20 PM, Pat McGowan wrote:
>
> >I was connected to an AP that required a login through a web api. System
> >settings were up I entered the web code, the network came on, then settings
> >indicated update available Tried to get the update, then it failed as
> >described.
>
> I wonder if the login is confusing u-d-m? Let's say it doesn't recognize that
> the login is necessary, so it gets garbage for the file downloads (but not
> errors). Then, when the signatures are checked, they're bogus because the
> downloaded files are bogus.
>
> I suppose one way to combat this is to pass the hashes to u-d-m when we know
> them, as in LP: #1262256. But we don't know all the hashes so that won't be a
> complete solution.

Yeah, especially in this particular case as we don't have the hashes of
the GPG tarballs since I haven't found any obvious location for those
short of introducing a new gpg.json at the root (which would then suffer
from the same lack of checksum anyway...).

--
Stéphane Graber
Ubuntu developer
http://www.ubuntu.com