[Bug 1897930] Re: use something better than md5sum to verify image contents

[Dimitri John Ledkov]

this is not meant to be cryptographic authenticity check.

it's meant to be a quick check against media corruption.

for authenticity checks we do publish sha256sum of the .iso, gpg sign
the package pool, and gpg sign filesystem.squashfs for when booting over
the network.

md5sum is fastest CRC like function. If there is anything faster we
would use that. I.e. we might use blake3 instead. But not sha256 it's
very slow.

** Changed in: casper (Ubuntu)
       Status: New => Opinion

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to casper in Ubuntu.
https://bugs.launchpad.net/bugs/1897930

Title:
  use something better than md5sum to verify image contents

Status in casper package in Ubuntu:
  Opinion

Bug description:
  Apologies if this is the wrong package to report against.

  When booting an ISO the check to verify the ISO integrity is run.

  Pressing escape from the plymouth screen I note that md5sum is
  reported to be used to verify the contents.

  Suggest sha256 in the future especially as sha256 is now used when
  publishing the ISO.

  ProblemType: Bug
  DistroRelease: Ubuntu 20.10
  Package: casper 1.452
  ProcVersionSignature: Ubuntu 5.8.0-20.21-generic 5.8.10
  Uname: Linux 5.8.0-20-generic x86_64
  NonfreeKernelModules: zfs zunicode zavl icp zcommon znvpair
  ApportVersion: 2.20.11-0ubuntu48
  Architecture: amd64
  CasperMD5CheckResult: pass
  CasperVersion: 1.452
  CurrentDesktop: Budgie:GNOME
  Date: Wed Sep 30 15:58:38 2020
  LiveMediaBuild: Ubuntu-Budgie 20.10 "Groovy Gorilla" - Beta amd64 (20200930)
  ProcEnviron:
   TERM=xterm-256color
   PATH=(custom, no user)
   XDG_RUNTIME_DIR=<set>
   LANG=en_US.UTF-8
   SHELL=/bin/bash
  SourcePackage: casper
  UpgradeStatus: No upgrade log present (probably fresh install)
  mtime.conffile..etc.casper.conf: 2020-09-30T15:48:57.324000

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/casper/+bug/1897930/+subscriptions