On Monday, September 03, 2012 13:37:45 cagsm wrote:

[...] Why not early on distributing the bits and load instead of everyone hammering direct download sites on day0 ?

This is the wrong list for this, let's discuss elsewhere.

Didnt Suse first open the torrent files on the mirrors before in the past and only then later offering the other binaries as well to ease the load?

You can do this only on a per directory basis, Andreas -- Andreas Jaeger aj@{suse.com,opensuse.org} Twitter/Identica: jaegerandi SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany GF: Jeff Hawn,Jennifer Guild,Felix Imendörffer,HRB16746 (AG Nürnberg) GPG fingerprint = 93A3 365E CE47 B889 DF7F FED1 389A 563C C272 A126 -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Am 03.09.2012 18:08, schrieb cagsm:

verified that: the torrents below of the large x86 and x64 .iso match the hashes posted earlier

openSUSE-12.2-DVD-i586.iso: A73C 877F 4F52 F80D D7D5 B768 8015 9772 7200 A7C5 openSUSE-12.2-DVD-x86_64.iso: D11B E175 60C2 B68F DDF9 31A6 AE0B 2947 BD00 9A10

I am honestly a bit confused by that thread. You verified unofficial hashes against unofficial downloads? -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Am 03.09.2012 19:19, schrieb cagsm:

they are the original torrents though, as the infohashes were taken from the .torrent files that were uploaded to the mirrors and some russian mirror published the files early.

verify the hashes as soon as your sources show the torrents. the opensuse trackers are also replying to the infohashes and opensuse mirror hostnames are amongst the participating hosts

On Mon, Sep 3, 2012 at 6:10 PM, Martin Helm wrote:

...

I am honestly a bit confused by that thread. You verified unofficial hashes against unofficial downloads?

I think you did not understand what I meant. Without confirmation by an official source (opensuse.org) what you post does not become official just because you say so. There is no chain of trust here: Someone took something from somewhere and claims it is official without confirmation from the project which produces that something. That kind of defeats any rules for distribution of binaries for an operating system which claims to be secure. I don't think that helps anyone and does more harm than good even if the iso's are the right ones. What is the point here in doing that instead of just waiting the remaining two days until official release. IMHO nothing. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

they are signed by the project keys as the .asc files are available too. samples: gpg --check-sigs 0x3DBDC284 pub 2048R/3DBDC284 2008-11-07 [expires: 2014-05-04] uid openSUSE Project Signing Key sig!3 3DBDC284 2010-05-05 openSUSE Project Signing Key sig!3 3DBDC284 2008-11-07 openSUSE Project Signing Key sig! 0175623E 2012-08-23 Marcus Meissner sig! 3D25D3D9 2012-08-23 SuSE Security Team gpg --fingerprint 0x3DBDC284 pub 2048R/3DBDC284 2008-11-07 [expires: 2014-05-04] Key fingerprint = 22C0 7BA5 3417 8CD0 2EFE 22AA B88B 2FD4 3DBD C284 uid openSUSE Project Signing Key gpg -vvvv --verify openSUSE-12.2-DVD-i586.iso.asc gpg: armor: BEGIN PGP SIGNATURE gpg: armor header: Version: GnuPG v1.0.7 (GNU/Linux) :signature packet: algo 1, keyid B88B2FD43DBDC284 version 3, created 1346320655, md5len 5, sigclass 0x00 digest algo 8, begin of digest d6 e4 data: [2048 bits] gpg: assuming signed data in `openSUSE-12.2-DVD-i586.iso' gpg: Signature made 08/30/12 11:57:35 using RSA key ID 3DBDC284 gpg: using PGP trust model gpg: Good signature from "openSUSE Project Signing Key " gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 22C0 7BA5 3417 8CD0 2EFE 22AA B88B 2FD4 3DBD C284 gpg: binary signature, digest algorithm SHA256 openSUSE-12.2-DVD-i586.iso.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iQEVAwUAUD85D7iLL9Q9vcKEAQjW5AgAi2DBbHIfH0W9QdixpWko6xhO8jzN DgMLkquyRSm6qjxLIiIDa1qc9D27HYZOyiyVXObJZ4Y8L+eHFfMlQcKKImqO9JvJ fGlFE6EAA2+ynl5TaGm7+yd81AzFf9pnSynf5z8K6CN9VOc2DO8TDG7OMl82Unxc +96ML8eIW2sY8ENxpu2xVdhbN2fi1rSoqsw4a5DI2TogUVL5N65OgREqVYmVvzgv WqMwZp+c5zuSNnMDFOkn2jfOGZxHYYXK0VnFMBNjDiXDjyOeaOloCj3e0KwVudGj TtsMu5ME/9kRtVYf5RjfOmN6Krqrd8CrE+lvR4kTJ9a7WV+oHpFa0sXuHA== =Rg3E -----END PGP SIGNATURE----- gpg -vvvv --verify openSUSE-12.2-DVD-x86_64.iso.asc gpg: armor: BEGIN PGP SIGNATURE gpg: armor header: Version: GnuPG v1.0.7 (GNU/Linux) :signature packet: algo 1, keyid B88B2FD43DBDC284 version 3, created 1346320960, md5len 5, sigclass 0x00 digest algo 8, begin of digest 53 8f data: [2048 bits] gpg: assuming signed data in `openSUSE-12.2-DVD-x86_64.iso' gpg: Signature made 08/30/12 12:02:40 using RSA key ID 3DBDC284 gpg: using PGP trust model gpg: Good signature from "openSUSE Project Signing Key " gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 22C0 7BA5 3417 8CD0 2EFE 22AA B88B 2FD4 3DBD C284 gpg: binary signature, digest algorithm SHA256 openSUSE-12.2-DVD-x86_64.iso.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iQEVAwUAUD86QLiLL9Q9vcKEAQhTjwgA0sgMYWlr+on1LGW7kxtAqKK1qkVx H+rJCe+lvoPYUeJ7wgCgoHoqwj8XjCRhdGP98czgSD1lGatnUYanFHUpfo/Eif4B MHfeqN67CjkN3XWphLormelxCjRcJx/7K6Sc2VvSFUFDj+Xsbv8FZ6AuwNP9JTND RYidZB6X4rOWQ/+/FmX8qEEQogrL82BnCM3J4SToFhpJ9QivVmAhA37HeL8K58Uf ptnYtGCY17fLg38CaN/1t5kz2+gCigoBNhkaK6KBaHwCEGSiCQRVCA076QO920us eYJafXhw3fbabfLDVc4eiPWpqUruUWZPIUXA3izz47chRxE2F3O16obZFw== =hIzU -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 2012-09-04 10:27, cagsm wrote:

they are signed by the project keys as the .asc files are available too. samples:

No matter what you say or show, they are unofficial till some official authority from openSUSE say they are. - -- Cheers / Saludos, Carlos E. R. (from 11.4 x86_64 "Celadon" (Minas Tirith)) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.16 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iF4EAREIAAYFAlBF5GIACgkQja8UbcUWM1yWsgD/fxo91nyIhJG5xTe8JRHqy6h0 kpa1hlXE0kRrNOILen4BAJDnzu+vtw3Mxr/MIJ0Tm/jBjKtLrNvqOi3KN8PlxolH =lcSJ -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 2012-09-04 14:16, cagsm wrote:

Just to make this long story short and not to give in to all the lil haters around.

What are you talking about? You must be deaf, you are not listening to what we say. - -- Cheers / Saludos, Carlos E. R. (from 11.4 x86_64 "Celadon" (Minas Tirith)) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.16 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iF4EAREIAAYFAlBF+EwACgkQja8UbcUWM1waNQD7BhnP5vVMAb0kUvBHeqCIlUE3 QCP4tI9W72E4MxRGGe4A/jH2k5mmB2wQzdumEzLpJp59gR+4MfzbAOQmrL9cyEuR =2Bw5 -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 9/3/2012 4:10 AM, Andreas Jaeger wrote:

openSUSE 12.2 is not released yet, so nobody will confirm this. Have a few more days patience, please

Andreas

Can we put this to bed now? http://news.opensuse.org/2012/09/05/opensuse-12-2-green-means-go/ -- _____________________________________ ---This space for rent--- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 2012-09-07 12:34, cagsm wrote:

this is really full of funny answers and avoiding clear take on the matter I had originally asked.

Yep. Yours specially. :-) - -- Cheers / Saludos, Carlos E. R. (from 11.4 x86_64 "Celadon" (Minas Tirith)) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.16 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iF4EAREIAAYFAlBJ4XgACgkQja8UbcUWM1zKuAD+IAaj4qvBqBiijO9vYlx8g89Y /CmWnRN0qkYRMC9MG9kA/1PAx7WJnA4pCuR6qMdrqHcg3rXcAHC7RwcMne+aEhII =UNfw -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org