verify .iso images?

[johnsonx42]

Are the .iso's from download.untangle.com and sourceforge supposed to be the same?

I just downloaded untangle_811_x32.iso from download.untangle.com using two different computers at two different locations, and neither one matched the MD5SUM in untangle_811_notes.txt (from sourceforge).

I got 75ef561c31f1621a968a94f517b33b8b from my most recent download here at home; I'm not 100% certain but I think that's the same as I got when I downloaded it at my office earlier this evening (I didn't record it, but I'm pretty sure it began with 75).

I got a good download from one of the sourceforge mirrors, cdnetworks in san jose with the correct MD5 of 863f3736e4db94b8af60c4e21f20a1b4.

Has anyone verified the .iso images on download.untangle.com?

[WebFooL]

Johnsonx42 ISO files from untangle.com will get a unique MD5 ever time it is downloaded.
If you are going to match it you need to download it form SF.

[johnsonx42]

Johnsonx42 ISO files from untangle.com will get a unique MD5 ever time it is downloaded.

why? what is different? please educate me

[WebFooL]

use the search function there is at least 10-20 post going through it.

But in short the untangle server do some magic during the download to "brand" the ISO so it get a different MD5 for every download.

[johnsonx42]

ok, so I see the 6 bytes from 0x823E to 0x8243 are ascii zeros in the source forge download, but seem to be some sort of incrementing serial number or timestamp in the untangle.com download. I got "10f64j" on my earlier download, and "10f66d" on one that I just completed.

just curious what the purpose of this is?

edit: sorry, posted at the same time as yours... thank you for your answer; I'll search and read about it.

[WebFooL]

johnsonx42,
I don't think that there is a "correct" answer on the forum.

If i have to guess i think it is to track the ISO's but then i don't really know :P

[johnsonx42]

I found where mrunkel said "the md5 from our website is not consistent. It varies with every download because of some magic our web guys perform to track activation rates. This is the same reason download resume doesn't work."

I suspect the untangle guys laugh every time someone new discovers they can't verify the md5sum on the download...

I prefer to check the MD5 for any important iso download, particularly one that's going to install a customer's server, not because I think TCP packets magically get corrupted over the internet, but because weird things happen sometimes. I've seen bad ISO's get uploaded by the company itself, I've run into more than one corrupted sourceforge mirror, I've had a computer with flaky RAM corrupt a download (yet the computer ran fine), etc.

So, I'll be sticking with the sourceforge downloads.

[hlarsen]

I suspect the untangle guys laugh every time someone new discovers they can't verify the md5sum on the download...

trust me, i wish it could be as simple as posting the hashes on our official download page - at this point when i explain it i feel like Will Ferrell in Old School when he blacks out while answering the debate question =)

[johnsonx42]

@hlarsen - lol

[GeneralEclectic]

All this angst could be easily avoided if they'd explain this in a paragraph on the download page. It's like they're trying to hide it for.... why??? Here, I'll take a shot at it. Untangle people, feel free to copy/paste. Copyright waived!

"Note: There is no checksum available for these downloads because of serialization bytes they contain. The only download verification available is file size which is listed with each file. Files downloaded from Sourceforge do not contain serialization and can be verified with the checksum posted on their download page."

There ya go. Easy Peasy. End of ridiculous mystery and endless repeated postings of the same question in the forums.