[TriLUG] Mandrake 8.2

[Jeremy P]

On Tue, 19 Mar 2002, That One Guy wrote:

> On Tuesday 19 March 2002 01:33 pm, Sinner from the Prairy wrote:
> 
> > The isos are at FatAlpha right now. Let's wait for official announcement
> > from Kevin. But they are there... with a proper md5sum
> 
> How can you be sure those are the proper (i.e. - Authentic) MD5 sums?  If 
> someone were going to change the ISO images on a given mirror, don't you 
> think they'd change the hashes as well?

Right, but presumably you'd want to download the md5sum file from the
original source; not from the mirror.  Since the md5sum files are tiny,
that doesn't represent undue load on the source.  Ideally these could be
GPG signed, but I don't know if anyone does that.  Red Hat does GPG sign
the RPM packages (contianed within the ISOs) -- does Mandrake do that too?

--Jeremy