Linux Magazine Fedora 16 DVD - integrity

Cliff Frisby · External Since: Mar 03, 2012 Posts: 6

Is anyone here in possession of a Fedora 16 DVD as covermounted on the
January issue of Linux Magazine?

If so, would anyone like to volunteer to give me the hash of the file
Packages/java-1.7.0-openjdk-1.7.0.0-0.1.20110803.1.fc16.i686.rpm
on their copy?

I noticed that the sha256 of the entire DVD (minus padding) did not match
Fedora's own, but there were no I/O errors suggesting a disc fault.

I downloaded the corresponding ISO (negating part of the reason for buying
the magazine, of course), mounted both the image and the DVD, ran a
recursive diff, and the above file cropped up as the offending article.

Further investigation revealed that a sizable chunk of the file was
non-matching, though the size of it did not seem to correspond to a
multiple of the block size. The 'bad' data was not all ones, all zeros, or
anything else resembling a discernible pattern. There was no difference in
the file sizes or dates.

Obviously I won't be using the DVD now, but I'm naturally curious to know
whether mine is a one-off. And if not, then to know what might be going on.

Cliff

Neil Ellwood · External Since: Nov 05, 2006 Posts: 28

On Sat, 03 Mar 2012 18:09:47 +0000, Cliff Frisby wrote:

> Is anyone here in possession of a Fedora 16 DVD as covermounted on the
> January issue of Linux Magazine?
>
> If so, would anyone like to volunteer to give me the hash of the file
> Packages/java-1.7.0-openjdk-1.7.0.0-0.1.20110803.1.fc16.i686.rpm on
> their copy?
>
> I noticed that the sha256 of the entire DVD (minus padding) did not
> match Fedora's own, but there were no I/O errors suggesting a disc
> fault.
>
> I downloaded the corresponding ISO (negating part of the reason for
> buying the magazine, of course), mounted both the image and the DVD, ran
> a recursive diff, and the above file cropped up as the offending
> article.
>
> Further investigation revealed that a sizable chunk of the file was
> non-matching, though the size of it did not seem to correspond to a
> multiple of the block size. The 'bad' data was not all ones, all zeros,
> or anything else resembling a discernible pattern. There was no
> difference in the file sizes or dates.
>
> Obviously I won't be using the DVD now, but I'm naturally curious to
> know whether mine is a one-off. And if not, then to know what might be
> going on.
>
> Cliff

Probably the regular updating that occurs with Fedora and most other
distros almost daily.

--
Neil
Reverse 'a' and 'r' then delete 'l' for address.

Cliff Frisby · External Since: Mar 03, 2012 Posts: 6

Neil Ellwood wrote:

<snip>
>
> Probably the regular updating that occurs with Fedora and most other
> distros almost daily.

That was my initial expectation when the DVD checksum failed.

But since it is just a single package file, with no change in file name as
would normally be the case, I must reject that hypothesis.

The package fails a standalone signature check -- how could it be
otherwise? -- but I wonder whether the Fedora installer checks signatures
when installing from the media it was itself booted from. I'll try it if I
can find a spare machine with enough RAM.

Tim Watts · External Since: Sep 24, 2011 Posts: 18

Cliff Frisby wrote:

> Neil Ellwood wrote:
>
> <snip>
>>
>> Probably the regular updating that occurs with Fedora and most other
>> distros almost daily.
>
> That was my initial expectation when the DVD checksum failed.
>
> But since it is just a single package file, with no change in file name as
> would normally be the case, I must reject that hypothesis.
>
> The package fails a standalone signature check

Don't trust it - it is either corrupted (most likely I suspect) or been "got
at".

> -- how could it be
> otherwise? -- but I wonder whether the Fedora installer checks signatures
> when installing from the media it was itself booted from. I'll try it if I
> can find a spare machine with enough RAM.
--
Tim Watts

Martin Gregorie · External Since: Jun 26, 2009 Posts: 94

On Sun, 04 Mar 2012 21:15:45 +0000, Cliff Frisby wrote:

> but I wonder whether the Fedora installer checks
> signatures when installing from the media it was itself booted from.
>
Yes, of course - provided that you run the media checks instead of
skipping them. AFAIK that's an exhaustive checksumming of every package
on the medium.

--
martin@ | Martin Gregorie
gregorie. | Essex, UK
org |

Cliff Frisby · External Since: Mar 03, 2012 Posts: 6

Martin Gregorie wrote:

> On Sun, 04 Mar 2012 21:15:45 +0000, Cliff Frisby wrote:
>
>> but I wonder whether the Fedora installer checks
>> signatures when installing from the media it was itself booted from.
>>
> Yes, of course - provided that you run the media checks instead of
> skipping them. AFAIK that's an exhaustive checksumming of every package
> on the medium.
>
>

Ah yes, I'd forgotten about that initial disc integrity check (although I
always imagined it was more of a flat image-checksumming rather than
individual packages).

Anyway, after reading your comment, I booted it in a diskless machine, ran
the media check, and it did indeed report itself as bad.

I'm still curious about it, because there are no I/O errors when reading off
the DVD. I'll try asking for a replacement.

Bruce Stephens · External Since: Aug 19, 2004 Posts: 196

Cliff Frisby writes:

[...]

> Ah yes, I'd forgotten about that initial disc integrity check (although I
> always imagined it was more of a flat image-checksumming rather than
> individual packages).

I'd assume that, too. RPMs are normally signed, IIRC, and I'd expect rpm
to check the signature on installation.

> Anyway, after reading your comment, I booted it in a diskless machine, ran
> the media check, and it did indeed report itself as bad.
>
> I'm still curious about it, because there are no I/O errors when reading off
> the DVD. I'll try asking for a replacement.

I'd guess it was some screwup on mastering, then. And likely nowadays
almost nobody uses magazine DVDs, and some tiny proportion of that uses
a GNU/Linux DVD (as opposed to Windows). OUr of curiousity I suppose it
might be worth looking at it. I'd guess it's corrupted, and so isn't
even valid RPM format.

Alec Ross · External Since: Dec 16, 2004 Posts: 32

In message , Bruce Stephens
writes
>Cliff Frisby writes:
>
>[...]
>
>> Ah yes, I'd forgotten about that initial disc integrity check (although I
>> always imagined it was more of a flat image-checksumming rather than
>> individual packages).
>
>I'd assume that, too. RPMs are normally signed, IIRC, and I'd expect rpm
>to check the signature on installation.
>
>> Anyway, after reading your comment, I booted it in a diskless machine, ran
>> the media check, and it did indeed report itself as bad.
>>
>> I'm still curious about it, because there are no I/O errors when reading off
>> the DVD. I'll try asking for a replacement.
>
>I'd guess it was some screwup on mastering, then. And likely nowadays
>almost nobody uses magazine DVDs, and some tiny proportion of that uses
>a GNU/Linux DVD (as opposed to Windows). OUr of curiousity I suppose it
>might be worth looking at it. I'd guess it's corrupted, and so isn't
>even valid RPM format.

Might well be worth contacting the mag w/ your pb, and findings, (along
w/ the DVD return?) so that they might analyse potential causes from
their end, and hopefully provide a better client experience in future.

--
Alec Ross

Cliff Frisby · External Since: Mar 03, 2012 Posts: 6

Bruce Stephens wrote:

> Cliff Frisby writes:
>
> [...]
>
>> Ah yes, I'd forgotten about that initial disc integrity check (although I
>> always imagined it was more of a flat image-checksumming rather than
>> individual packages).
>
> I'd assume that, too. RPMs are normally signed, IIRC, and I'd expect rpm
> to check the signature on installation.
>
>> Anyway, after reading your comment, I booted it in a diskless machine,
>> ran the media check, and it did indeed report itself as bad.
>>
>> I'm still curious about it, because there are no I/O errors when reading
>> off the DVD. I'll try asking for a replacement.
>
> I'd guess it was some screwup on mastering, then. And likely nowadays
> almost nobody uses magazine DVDs, and some tiny proportion of that uses
> a GNU/Linux DVD (as opposed to Windows). OUr of curiousity I suppose it
> might be worth looking at it. I'd guess it's corrupted, and so isn't
> even valid RPM format.

£5.99 to avoid a <4GB download is a bit steep, I agree, but at least this
particular magazine usually puts unadulterated verifiable base distros on
the DVD (notwithstanding the current problem), I usually learn a few
interesting things from the paper bit that I wouldn't learn otherwise, and
the newsagent gets some encouragement to stock Linux mags next month.

Cliff Frisby · External Since: Mar 03, 2012 Posts: 6

Alec Ross wrote:

<snip>
>
> Might well be worth contacting the mag w/ your pb, and findings, (along
> w/ the DVD return?) so that they might analyse potential causes from
> their end, and hopefully provide a better client experience in future.
>

Well, I've asked for a replacement, so we'll see what transpires.

chris · External Since: Feb 08, 2005 Posts: 72

On 05/03/2012 18:40, Bruce Stephens wrote:
> Cliff Frisby writes:
>
> [...]
>
>> Ah yes, I'd forgotten about that initial disc integrity check (although I
>> always imagined it was more of a flat image-checksumming rather than
>> individual packages).
>
> I'd assume that, too. RPMs are normally signed, IIRC, and I'd expect rpm
> to check the signature on installation.
>
>> Anyway, after reading your comment, I booted it in a diskless machine, ran
>> the media check, and it did indeed report itself as bad.
>>
>> I'm still curious about it, because there are no I/O errors when reading off
>> the DVD. I'll try asking for a replacement.
>
> I'd guess it was some screwup on mastering, then. And likely nowadays
> almost nobody uses magazine DVDs, and some tiny proportion of that uses
> a GNU/Linux DVD (as opposed to Windows).

Not true.

Recently in Linux Format there's been a big debate about whether to
shift from 32bit distros to 64bit on the DVD. Many people wrote in to
complain that DVDs are their only/main source of new OSes and that 64bit
was not what they wanted Because of that feedback Linux Format are
sticking with 32bit on their DVDs.

Don't forget that many of these magazines have readership far beyond our
shores where broadband is unavailable or too expensive.

Nix · External Since: Jul 29, 2004 Posts: 746

On 5 Mar 2012, Cliff Frisby uttered the following:
> £5.99 to avoid a <4GB download is a bit steep, I agree,

That depends. My parents get 4Gb a month bandwidth allowance (they're on
satellite broadband). £5.99 to avoid blowing that limit is surely worth
it to them.

--
NULL && (void)

Cliff Frisby · External Since: Mar 03, 2012 Posts: 6

Nix wrote:

> On 5 Mar 2012, Cliff Frisby uttered the following:
>> £5.99 to avoid a <4GB download is a bit steep, I agree,
>
> That depends. My parents get 4Gb a month bandwidth allowance (they're on
> satellite broadband). £5.99 to avoid blowing that limit is surely worth
> it to them.
>

It's good to feel that I did not need to be so humble in my defence!

Of course I ended up downloading it anyway, to do the diff. Nevertheless,
I'm assured that a replacement DVD is on its way.

Incidentally, I wonder how many people request a 'replacement' DVD without
actually buying the magazine at all. There appears to be no impediment to
doing so, other than scruples.

mechanic · External Since: Jan 10, 2010 Posts: 17

On Tue, 06 Mar 2012 15:07:44 +0000, Cliff Frisby wrote:

> Incidentally, I wonder how many people request a 'replacement' DVD
> without actually buying the magazine at all. There appears to be
> no impediment to doing so, other than scruples.

But what do you get that you can't download for free anyway? It's
all open source stuff.