--- pgp/contrib/md5sum/readme 2018/04/24 16:39:48 1.1.1.2 +++ pgp/contrib/md5sum/readme 2018/04/24 16:45:03 1.1.1.5 @@ -1,57 +1,82 @@ -This utility computes MD5 checksums of files, ignoring end-of-line -conventions unless the -b (binary) flag is set. The file "pgp23.md5" -contains the signatures of all the files in the source. If you are -in the source directory and run "md5sum -c pgp23.md5", you will get -an error message if any files fail to match. If all files match, -nothing will be printed. - -You need to borrow some files from the PGP sources to compile this -utility (md5.c, md5.h, and possibly the getopt implementation); -see the md5sum.c file for details. - -The file pgp23.md5 is signed by one of the developers, so you can be -reasonably sure it's correct. It would be possible for a hard-working -miscreant to fiddle with the distribution so all of this mutual checking -would not show any errors, but it's not going to happen accidentally. -And if you have a previous version of PGP that you trust, it's not going -to happen at all. - -The only other thing that's needed is a detached PGP signature of the -files md5sum.c, md5.c and md5.h, and anyone with a previous trusted -version of PGP can be sure that no tampering has occurred anywhere, and -that's here: - -md5sum.c: ------BEGIN PGP MESSAGE----- -Version: 2.3 - -iQBgAgUBLB2GKco9of2GWqfzAQEHNwJXcWywhAoq8hBOxRnk6IDU7FoltmeInXDS -kkO7qpM8yL34MChuXRn9P97FItJeWUatRPDIGSzO6Gqw+CA5jiRfI6Sj9zMBU1ef -VHR2 -=5EcU ------END PGP MESSAGE----- -md5.c: ------BEGIN PGP MESSAGE----- -Version: 2.3 - -iQBgAgUBLB2Ghso9of2GWqfzAQH0rQJVFoCqfOtnLe1hIKb21wIiX4VqPJbHg2B+ -p5AXczVVMoO7NyYaCuFEQfGeET+GMq3yqp4jH6/mQ8fglXHkPDwpR7D8/f2Opl2g -MLRg -=TVF4 ------END PGP MESSAGE----- -md5.h: ------BEGIN PGP MESSAGE----- -Version: 2.3 - -iQBgAgUBLB2Gnco9of2GWqfzAQGORQJXSH/dr7rvLw2mtwZx/+8gzPjVVmTLapek -2hWo4LOu1/oBFYZN/C/ZQogr7XTk6vJiL4GqrDNWzzi+q1au3dUMO4FP/eFD/fke -AB30 -=+Hn6 ------END PGP MESSAGE----- - -(And my and Branko's keys are in the supplied key ring, signed by -Philip Zimmermann, so you know that we are who we say we are, and if -there are any trojan horses in the source, you know who put them there. -Isn't security fun?) --- - -Colin +Instructions for the MD5SUM Utility +----------------------------------- + +This utility computes MD5 checksums of files, ignoring end-of-line +conventions unless the -b (binary) flag is set. + +This utility can be used to check the integrity of any files. For +this discussion, we'll be checking the files in the PGP source code +release. For PGP version 2.6.3i, the file containing all the MD5 +message digests is called "pgp263i.md5", but for other versions of PGP, +the filename will change to reflect the new version number. + +The file "pgp263i.md5" contains the signatures of all the files in the +source. If you are in the PGP base directory and run + + md5sum -c contrib/md5sum/pgp263i.md5 + +you will get an error message if any files fail to match. If all +files match, nothing will be printed. + +You need to borrow some files from the PGP sources to compile this +utility (md5.c, md5.h, and possibly the getopt implementation); +see the md5sum.c file for details. On some platforms, you may have +to compile md5.c with the -DHIGHFIRST flag, or the MD5 sums will be +wrong. Two makefiles, one for Unix and one for Amiga, are included. +These should be a good starting point for tailoring makefiles on +other systems. + +The file pgp263i.md5 is signed by stale@hypnotech.com, so you can be +reasonably sure it's correct. It would be possible for a hard-working +miscreant to fiddle with the distribution so all of this mutual checking +would not show any errors, but it's not going to happen accidentally. +And if you have a previous version of PGP that you trust, it's not going +to happen at all. + +The only other thing that's needed is a detached PGP signature of the +files md5sum.c, md5.c and md5.h, and anyone with a previous trusted +version of PGP can be sure that no tampering has occurred anywhere, and +that's here: + +md5sum.c: +-----BEGIN PGP MESSAGE----- +Version: 2.6.3i + +iQCVAgUAMPZzGrCfd7bM70R9AQH7PQQAiyd/myRHDk8IrzpB/4sVO3Slj8tZc3dE +5Swfe3GkBpTyTvZYbqxwq1HQu5mAJbJsMbZD2s8D3BWKYAJZfrkNmutVKE6n9UVu +eS2DXBPSalCZmQcv0UcHzbca9mExhgi4HGwy81kvUOAI6YWB22bYsk4DgciCRUx6 +6wcNUMPqN+Q= +=HUeq +-----END PGP MESSAGE----- + +md5.c: +-----BEGIN PGP MESSAGE----- +Version: 2.6.3i + +iQCVAgUAMPZzOrCfd7bM70R9AQHYQgP/aPMSp1knVNWkw/D3AW+WtE/qJ88M7FYN ++v9DZjwdNpCMETUFHBRqzL2gx+A9OXlCnIVf38fDlyHIdiJz1pOtYhataV9XtVp9 +iS+ayzB3Yv7dUrPhynXsKGjtD9YjQ0wgvuuFKqchq1B6Cn3yYkN4pwGhRvAXO8x1 +Vz/OU+Ywd4M= +=bzeZ +-----END PGP MESSAGE----- + +md5.h: +-----BEGIN PGP MESSAGE----- +Version: 2.6.3i + +iQCVAgUAMPZzS7Cfd7bM70R9AQH6EgQAqIlxNGYAq3Ynx8DdCeq32/2qZQoDdVHl +BwEQIv05clQsI01VnVsh4cNig3cTV+wg99UklOhzgiATQc3vFumgFkEJkF7bII1S +LZTNdBm561/029KIBv9dzMdArarNqAQQ6iJnaepVyNzC73xTyFCtEcTz4UFg+WV3 +nbw9gIGnx70= +=1cCa +-----END PGP MESSAGE----- + +These signatures were generated by stale@hypnotech.com. His key is +supplied in the keys.asc file in the PGP distribution and is signed +by various PGP developers, so you know that we are who we say we are, +and if there are any trojan horses in the source, you know who put +them there. Isn't security fun?) +-- + -Colin + Revised by Jeffrey I. Schiller + Revised by Stale Schumacher