--- pgp/contrib/md5sum/readme 2018/04/24 16:43:18 1.1.1.3 +++ pgp/contrib/md5sum/readme 2018/04/24 16:44:21 1.1.1.4 @@ -1,15 +1,30 @@ +Instructions for the MD5SUM Utility +----------------------------------- + This utility computes MD5 checksums of files, ignoring end-of-line -conventions unless the -b (binary) flag is set. The file "pgp261.md5" -contains the signatures of all the files in the source. If you are in -the source directory and run "md5sum -c ../contrib/md5sum/pgp261.md5", +conventions unless the -b (binary) flag is set. + +This utility can be used to check the integrity of any files. For +this discussion, we'll be checking the files in the PGP source code +release. For PGP version 2.6.2, the file containing all the MD5 +message digests is called "pgp262.md5", but for other versions of PGP, +the filename will change to reflect the new version number. + +The file "pgp262.md5" contains the signatures of all the files in the +source. If you are in the source directory and run + + md5sum -c ../contrib/md5sum/pgp262.md5 + you will get an error message if any files fail to match. If all files match, nothing will be printed. You need to borrow some files from the PGP sources to compile this utility (md5.c, md5.h, and possibly the getopt implementation); -see the md5sum.c file for details. +see the md5sum.c file for details. On some platforms, you may have +to compile md5.c with the -DHIGHFIRST flag, or the MD5 sums will be +wrong. -The file pgp261.md5 is signed by jis@mit.edu, so you can be +The file pgp262.md5 is signed by jis@mit.edu, so you can be reasonably sure it's correct. It would be possible for a hard-working miscreant to fiddle with the distribution so all of this mutual checking would not show any errors, but it's not going to happen accidentally.