[RFE] Downloading checksums instead of hardcoding

[adrianreber]

There is currently a discussion at MirrorManager (https://github.com/fedora-infra/mirrormanager2/pull/205) if the code to add ISO checksums to the database and thus to the metalink should be removed or not?

MediaWriter as a possible consumer has been mentioned and I wanted to get your input if that would be something useful for MediaWriter. MediaWriter could use URLs like this to verify the checksum:

https://mirrors.fedoraproject.org/metalink?path=pub/archive/fedora/linux/releases/20/Live/x86_64/Fedora-Live-Desktop-x86_64-20-1.iso

It is currently broken for newer images but is this something which would make sense for MediaWriter or not? If not I would like to remove it from MirrorManager.

[MartinBriza]

It would definitely make sense, either directly or indirectly. How it's done now is not exactly hardcoding - we use the releases.json metadata file. There is one, embedded inside FMW, which includes static data for the last stable release. There is also the https://getfedora.org/releases.json file, which includes information about newer releases. As of now, I don't think it's generated by the website build scripts, however we're planning to add the support. From this point, I think the direct approach would be to download the checksums directly with FMW on runtime but it'd also be possible to fetch them with the releases.json generator on getfedora.org.

[adrianreber]

Thanks for the reply. I will leave the feature in MirrorManager and will let you know once it is fixed and works for newer releases than Fedora 21.

[MartinBriza]

Thank you Adrian, I will wait.

2017-03-29 21:54 GMT+02:00 Adrian Reber [email protected]:

Thanks for the reply. I will leave the feature in MirrorManager and will let you know once it is fixed and works for newer releases than Fedora 21.

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/MartinBriza/MediaWriter/issues/78#issuecomment-290206128, or mute the thread https://github.com/notifications/unsubscribe-auth/ADyw4FTOoDeCy5T6251-fEFkjYl8iPSwks5rqrb6gaJpZM4Mr0BL .

[adrianreber]

Links like this should give you the sha256 checksums of all ISOs:

https://mirrors.fedoraproject.org/metalink?path=pub/fedora/linux/releases/25/Everything/x86_64/iso/Fedora-Everything-netinst-x86_64-25-1.3.iso

Please let me know if any checksums are missing from the metalink. I hope these links can be useful for MediaWriter

[juhp]

https://mirrors.fedoraproject.org/metalink?path=pub/fedora/linux/releases/25/Everything/x86_64/iso/Fedora-Everything-netinst-x86_64-25-1.3.iso

Is that still supposed to work now? I couldn't get a positive response for any path I tried (except if it doesn't start with pub/fedora/linux I get a different error message).

Edit: nvm reading the MM ticket - I suppose not...

[adrianreber]

We actually never removed this code. All the information is still there, but the recent rewrite of one part in Rust has unintentionally dropped the functionality. It would not be too difficult to get it back.

All the data is still on the master mirror, we still put it into the database, we transfer it to the mirrorlist frontends (generating the metalink answers) but we hardcoded to only generate metalinks for repomd.xml files.

Thanks for the question, I was not aware I disabled this feature. It is easy to activate again if you want.

[juhp]

If it can be re-enabled easily that would be welcome, since it could be useful in some cases, thanks

[adrianreber]

I updated the mirrorlist-server to provide the metalink information for all files if we have the necessary information. It will take some time until it makes it way to the Fedora production systems.

I will update the ticket once the information can be used.

[adrianreber]

Looking at

https://mirrors.fedoraproject.org/metalink?path=pub/fedora/linux/releases/32/Workstation/x86_64/iso/Fedora-Workstation-Live-x86_64-32-1.6.iso

I can now see a checksum. Should be ready to be used.