Bug 36303

Summary:	show link to checksums, signatures, etc. on download page
Product:	LibreOffice	Reporter:	jweaver28 <jweaver28>
Component:	WWW	Assignee:	Not Assigned <libreoffice-bugs>
Status:	CLOSED FIXED
Severity:	enhancement
Priority:	medium
Version:	3.3.2 release
Hardware:	All
OS:	All
Whiteboard:
Crash report or crash signature:		Regression By:

Description jweaver28 2011-04-16 08:30:54 UTC

Today I downloaded and installed openoffice rather than libreoffice on my newly built desktop. It's because I'm not THAT technical and don't have unlimited time. IMHO, after over an hour's searching it seems libreoffice just simply has a policy against publishing checksums. That policy's unspoken--just the word checksum produces no results in the only page which allows insite search (FAQs), and the threads which mention links lead to dead pages. Googling (libreoffice checksum) shows lots of times the matter's been raised--and denied. 

My problem is that I've gotten malware, despite a VERY conservative download policy. A couple of times, the malware's been on motherboard manufacturer cds. Most recently was because I downloaded xbmc10--and 2 months later malwarebytes found that a trojan bootloader had been included in the code. Probably the reason it was found so quickly was that xbmc is open source. But the reason the problem happened in the first place is because BOTNETS ARE BIG BUSINESS. They are the antithesis of the productivity and transparency libreoffice espouses. And the proven method of keeping software malware-free (and to catch such malware) is checksumming.

Comment 1 jweaver28 2011-04-16 08:31:39 UTC

The latest version of libreoffice seems to be 3.3.3 but the link leads to 3.3.2.

Comment 2 Caolán McNamara 2011-04-16 09:16:31 UTC

The latest version is indeed currently 3.3.2

The required data exists, e.g. http://download.documentfoundation.org/libreoffice/stable/3.3.2/win/x86/LibO-SDK_3.3_Win_x86_install_multi.exe.mirrorlist but not connected to the website itself

Comment 3 jweaver28 2011-04-16 10:46:35 UTC

Thanks, Caolan (and sorry I haven't figured out how to do accents). The link works and the download checksummed fine. Now if only that result showed in the first 3 pages of google results, or had an easier link within the original download page;) .....

FYI, although I've gotta get other work done and don't need a reply--nor am I trying to get the last word!
Seems odd that when I put in my language and OS, the normal download link page told me I had two options, a 214MB multi.exe file and an 8 MB helppack_Eng-US.exe file, which is the same size as the link I used from your email (and that checksummed).

Jane.



> From: bugzilla-daemon@freedesktop.org
> To: jweaver28@hotmail.com
> Subject: [Bug 36303] show link to checksums, signatures, etc. on download page
> Date: Sat, 16 Apr 2011 09:16:31 -0700
> 
> https://bugs.freedesktop.org/show_bug.cgi?id=36303
> 
> Caolán McNamara <caolanm@redhat.com> changed:
> 
>            What    |Removed                     |Added
> ----------------------------------------------------------------------------
>             Summary|anti-checksum policy        |show link to checksums,
>                    |                            |signatures, etc. on
>                    |                            |download page
>            Severity|critical                    |normal
>            Priority|highest                     |medium
>           Component|Installation                |WWW
> 
> --- Comment #2 from Caolán McNamara <caolanm@redhat.com> 2011-04-16 09:16:31 PDT ---
> The latest version is indeed currently 3.3.2
> 
> The required data exists, e.g.
> http://download.documentfoundation.org/libreoffice/stable/3.3.2/win/x86/LibO-SDK_3.3_Win_x86_install_multi.exe.mirrorlist
> but not connected to the website itself
> 
> -- 
> Configure bugmail: https://bugs.freedesktop.org/userprefs.cgi?tab=email
> ------- You are receiving this mail because: -------
> You reported the bug.

Comment 4 Christian Lohmaier 2011-05-19 05:02:42 UTC

download page has a "show details" option now that will add the mirrorlist URLs

Probably some point later the page will be "ajaxified" to asynchronously load the md5sum without the need of having the user visit the mirrorlist page.

Comment 5 Christian Lohmaier 2011-05-19 05:04:56 UTC

as a sidenote: If you're just interested in the md5sum, you can also just append ".md5" instead of ".mirrorlist" - same with ".sha1" for the sha1sum.

closing.