0
I've downloaded the Glassfish zip file from http://glassfish.java.net/downloads/3.1.1-final.html and I'd like to verify the integrity of the file, but I can't find any checksums.
Where can they be found?
I've searched the Glassfish website, Google, stackoverflow, superuser and serverfault but haven't found any mention of them.
chritohnide
Posted 2011-09-20T11:12:58.110
Reputation: 198
1
The simplest answer – the Glassfish developers don't provide any checksums for download verification, like slhck said – might just be correct.
md5sums and signatures don't come automatically, they have to be created by whoever publishes the files, wasting minutes of their precious coffee-drinking time for very little gain in security (plain MD5 hashes served over insecure HTTP are useless) or integrity (ZIP archives already have CRC32 checksums, the 'sh' installers carry the same ZIP archives, and EXE installers can be self-verifying).
user1686
Posted 2011-09-20T11:12:58.110
Reputation: 283 655
It looks like you and slhck might be right. Which brings me to another question...
Maybe there are none. Why would you need them? Are you having trouble opening the archive? – slhck – 2011-09-20T11:28:23.360
Which version are you downloading? Full or web profile? Windows or *nix or zip archive? There's a few permutations to resolve here before we can find a reputaqble source of checksums – Rob Cowell – 2011-09-20T13:00:27.840
@slhck I wanted verification that the file I downloaded was authentic and not corrupt. However, after reading grawity's answer, I now remember that a checksum on its own can't verify the authenticity of a file. I could try the Windows exe and see if that has an embedded signature, but I really wanted the zip version for ease of installation. And there's no guarantee I won't have the same problem as what happened here.
– chritohnide – 2011-09-20T14:54:30.073@RobCowell I'm downloading the platform-independent zip file for GlassFish Server 3.1.1 Open Source Edition Full Platform – chritohnide – 2011-09-20T15:00:08.957
I tried downloading the Windows EXE for the same version and profile (glassfish-3.1.1-windows.exe) as the zip, but ran into the issue I've been having with other Oracle signed EXEs - the digital signature did not verify.
– chritohnide – 2011-09-20T15:06:11.503Hmm, one more possible explanation -- the JAR itself is signed? – user1686 – 2011-09-20T15:23:34.727
@grawity That's possible...although, there are quite a few JARs in that package! I'll check it out though. – chritohnide – 2011-09-20T15:47:18.177