Bug 36303 - show link to checksums, signatures, etc. on download page
Summary: show link to checksums, signatures, etc. on download page
Status: CLOSED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: WWW (show other bugs)
Version:
(earliest affected)
3.3.2 release
Hardware: All All
: medium enhancement
Assignee: Not Assigned
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-04-16 08:30 UTC by jweaver28
Modified: 2011-05-19 05:04 UTC (History)
0 users

See Also:
Crash report or crash signature:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description jweaver28 2011-04-16 08:30:54 UTC
Today I downloaded and installed openoffice rather than libreoffice on my newly built desktop. It's because I'm not THAT technical and don't have unlimited time. IMHO, after over an hour's searching it seems libreoffice just simply has a policy against publishing checksums. That policy's unspoken--just the word checksum produces no results in the only page which allows insite search (FAQs), and the threads which mention links lead to dead pages. Googling (libreoffice checksum) shows lots of times the matter's been raised--and denied. 

My problem is that I've gotten malware, despite a VERY conservative download policy. A couple of times, the malware's been on motherboard manufacturer cds. Most recently was because I downloaded xbmc10--and 2 months later malwarebytes found that a trojan bootloader had been included in the code. Probably the reason it was found so quickly was that xbmc is open source. But the reason the problem happened in the first place is because BOTNETS ARE BIG BUSINESS. They are the antithesis of the productivity and transparency libreoffice espouses. And the proven method of keeping software malware-free (and to catch such malware) is checksumming.
Comment 1 jweaver28 2011-04-16 08:31:39 UTC
The latest version of libreoffice seems to be 3.3.3 but the link leads to 3.3.2.
Comment 2 Caolán McNamara 2011-04-16 09:16:31 UTC
The latest version is indeed currently 3.3.2

The required data exists, e.g. http://download.documentfoundation.org/libreoffice/stable/3.3.2/win/x86/LibO-SDK_3.3_Win_x86_install_multi.exe.mirrorlist but not connected to the website itself
Comment 3 jweaver28 2011-04-16 10:46:35 UTC
Thanks, Caolan (and sorry I haven't figured out how to do accents). The link works and the download checksummed fine. Now if only that result showed in the first 3 pages of google results, or had an easier link within the original download page;) .....

FYI, although I've gotta get other work done and don't need a reply--nor am I trying to get the last word!
Seems odd that when I put in my language and OS, the normal download link page told me I had two options, a 214MB multi.exe file and an 8 MB helppack_Eng-US.exe file, which is the same size as the link I used from your email (and that checksummed).

Jane.



> From: bugzilla-daemon@freedesktop.org
> To: jweaver28@hotmail.com
> Subject: [Bug 36303] show link to checksums, signatures, etc. on download page
> Date: Sat, 16 Apr 2011 09:16:31 -0700
> 
> https://bugs.freedesktop.org/show_bug.cgi?id=36303
> 
> Caolán McNamara <caolanm@redhat.com> changed:
> 
>            What    |Removed                     |Added
> ----------------------------------------------------------------------------
>             Summary|anti-checksum policy        |show link to checksums,
>                    |                            |signatures, etc. on
>                    |                            |download page
>            Severity|critical                    |normal
>            Priority|highest                     |medium
>           Component|Installation                |WWW
> 
> --- Comment #2 from Caolán McNamara <caolanm@redhat.com> 2011-04-16 09:16:31 PDT ---
> The latest version is indeed currently 3.3.2
> 
> The required data exists, e.g.
> http://download.documentfoundation.org/libreoffice/stable/3.3.2/win/x86/LibO-SDK_3.3_Win_x86_install_multi.exe.mirrorlist
> but not connected to the website itself
> 
> -- 
> Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
> ------- You are receiving this mail because: -------
> You reported the bug.
Comment 4 Christian Lohmaier 2011-05-19 05:02:42 UTC
download page has a "show details" option now that will add the mirrorlist URLs

Probably some point later the page will be "ajaxified" to asynchronously load the md5sum without the need of having the user visit the mirrorlist page.
Comment 5 Christian Lohmaier 2011-05-19 05:04:56 UTC
as a sidenote: If you're just interested in the md5sum, you can also just append ".md5" instead of ".mirrorlist" - same with ".sha1" for the sha1sum.

closing.