Announcement

**GreyGeek** · Jun 10, 2009, 03:32 PM

Re: bit torrent download won't cksum

Every time I've downloaded a bit torrent using KTorrent it checked out ok, but bad downloads, even multiple times, do occur. You will even get bad downloads when you download an ISO file. Redo it, or change to a different mirror until you do get a good checksum.

Sometimes it is a problem with the transmission, sometimes the file and it's checksum text file get mixed up. And, on rare occasions, a hacker has broken in and replaced a good file with a hacked version.

Regardless, NEVER install a file when its checksum does not match the checksum value given on the download site.

Did you change the settings to let KTorrent check the chunks as they came down, so if they are bad they can be resent?

**tomcloyd** · Jun 10, 2009, 08:09 PM

Re: bit torrent download won't cksum

OK - changed that setting in KTorrent, per your recommendation. I now have this dataset:

537a22de1342d5671b7e0070f66a6076 <= second cksum
537a22de1342d5671b7e0070f66a6076 <= third cksum
537a22de1342d5671b7e0070f66a6076 <= fourth cksum (download with Ktorrent's new setting)

This is nowhere close to the supposed "right" cksum.

I have now idea how to make sense of this.

**Telengard** · Jun 10, 2009, 10:52 PM

Re: bit torrent download won't cksum

Where are you getting the checksum from? According to the MD5SUMS file on the mirrors, 537a22de1342d5671b7e0070f66a6076 is the correct md5sum for kubuntu-9.04-desktop-i386.iso:

Originally posted by MD5SUMS

a292c1caaedb481db56462f16453c408 *kubuntu-9.04-alternate-amd64.iso
a846a8059ebd37730f8b803e6cae9311 *kubuntu-9.04-alternate-i386.iso
798b8789af2f13bb9687b2ce57f25f9c *kubuntu-9.04-desktop-amd64.iso
537a22de1342d5671b7e0070f66a6076 *kubuntu-9.04-desktop-i386.iso

http://ubuntu.media.mit.edu/ubuntu-r...jaunty/MD5SUMS
http://mirror.anl.gov/pub/ubuntu-iso...jaunty/MD5SUMS
http://ftp.tu-chemnitz.de/pub/linux/...jaunty/MD5SUMS

Is the checksum you are comparing with actually from some other file?

**tomcloyd** · Jun 11, 2009, 01:45 AM

Re: bit torrent download won't cksum

Where did I get my chsum? Well, as I say in my email above [June 10, 2009, 03:55:35] I got it from ubuntu - not from any secondary source. Look at the page at this address -

http://torrent.ubuntu.com:6969/

The page title: BitTorrent download info

Use your browser search function to locate "Kubuntu-9", then locate the link "kubuntu-9.04-desktop-i386.iso". That's what I downloaded. Note the cksum next to it.

Hmmm. Maybe I found the problem. It's not called cksum. It's called "info hash". (look at the top of the column). Hadn't notice that before. What in BLAZES is that

If it's not a checksum what IS it and why is it there? I'm REALLY not understanding this. If they're going to offer a bit torrent download why is not the cksum right THERE? Isn't that how YOU'd set up the page?

I do hope someone can explain this to me. I really don't get it. I have to locate some mirror to find the cksum? Why? Very puzzling to me.

t.

**Telengard** · Jun 11, 2009, 09:19 AM

Re: bit torrent download won't cksum

AFAIK, the infohash is used internally by the tracker to distinguish between torrents. I don't think it is the md5um of the file, because some torrents contain more than one file. I don't know why they display it so prominently on the download page instead of some more obviously useful checksum. It seems to me you have a right to complain to Ubuntu.com for not providing an md5sum of their iso file.

The mirror sites are trustworthy, and that's why the official downloads page links to them. If you don't trust the same mirror you download the iso to also provide a correct checksum, then you should use a checksum obtained from one or more different mirrors. There is no way to be more certain, unless Ubuntu.com or Canonical, or whomever you trust is going to provide more obviously useful checksums.

The only way to avoid using a mirror is to order a CD, or download a torrent. You downloaded a torrent, which is fine. Your torrent client should be checking for corruption automatically as it downloads. It is damn near impossible to get a corrupted download with bittorrent, assuming your client software and your computer hardware work correctly.

The only question left is, do you trust that the torrent provided Ubuntu.com describes the true and original ISO file released by the Kubuntu team?

Edit: Finally, hidden deep within the Community Ubuntu Documentation pages, I found the UbuntuHashes article. Please note that this article is hosted on Ubuntu.com, the same domain which you already seem to have trusted to download your torrent file, and on a secure server at that.

Originally posted by UbuntuHashes

537a22de1342d5671b7e0070f66a6076 kubuntu-9.04-desktop-i386.iso

Do you trust the downloaded file now?

Edit:I downloaded kubuntu-9.04-desktop-i386.iso from one of the mirrors.

Code:

wget '[url]http://lug.mtu.edu/ubuntu-releases/kubuntu/jaunty/kubuntu-9.04-desktop-i386.iso'[/url]

Then I checked it against the md5sum provided by the UbuntuHashes article, using cfv (Commadline File Verifier)

Code:

$ cfv -v -C -t md5 -f - kubuntu-9.04-desktop-i386.iso
537a22de1342d5671b7e0070f66a6076 *kubuntu-9.04-desktop-i386.iso
kubuntu-9.04-desktop-i386.iso : OK (537a22de1342d5671b7e0070f66a6076)
-: 1 files, 1 OK. 10.622 seconds, 67080.9K/s

Lastly, I verified the file downloaded from the mirror against the torrent file you downloaded from the BitTorrent download info page

Code:

$ cfv -v -T -f kubuntu-9.04-desktop-i386.iso.torrent
testing from kubuntu-9.04-desktop-i386.iso.torrent (torrent, created Thu Apr 23 03:54:53 2009, Kubuntu CD releases.ubuntu.com)
kubuntu-9.04-desktop-i386.iso : OK (729608192,all pieces ok)
kubuntu-9.04-desktop-i386.iso.torrent: 1 files, 1 OK. 12.231 seconds, 58253.2K/s

As you can see, kubuntu-9.04-desktop-i386.iso downloaded from the mirror matches the md5sum provided by the UbuntuHashes article (537a22de1342d5671b7e0070f66a6076). The same file also matches the torrent file you downloaded from the BitTorrent download info page.

Now do you trust kubuntu-9.04-desktop-i386.iso?

Just to confirm my belief that the mirrors are trustworthy, I asked in #kubuntu on freenode IRC:

[12:28] <DaskreeCH> [#kubuntu] Telengard: They are also in a file within the ISO directory named MD5SUMS

The above mentioned MD5SUMS file is available on the mirror sites linked from the Complete Download Options List.

**GreyGeek** · Jun 11, 2009, 11:20 AM

Re: bit torrent download won't cksum

Originally posted by tomcloyd

OK - changed that setting in KTorrent, per your recommendation. I now have this dataset:

537a22de1342d5671b7e0070f66a6076 <= second cksum
537a22de1342d5671b7e0070f66a6076 <= third cksum
537a22de1342d5671b7e0070f66a6076 <= fourth cksum (download with Ktorrent's new setting)

This is nowhere close to the supposed "right" cksum.

I have now idea how to make sense of this.

Three identical checksums. They are all "right". That is the correct checksum given on every download page for the Kubuntu 9.04 iso that I've seen. It was the checksum for my download.

What's your confusion about?

**Telengard** · Jun 11, 2009, 11:32 AM

Re: bit torrent download won't cksum

Originally posted by GreyGeek

Three identical checksums. They are all "right". That is the correct checksum given on every download page for the Kubuntu 9.04 iso that I've seen. It was the checksum for my download. What's your confusion about?

He seems to be trying to compare the md5sum for kubuntu-9.04-desktop-i386.iso against the infohash shown on the BitTorrent download info page. To sum it up, he is comparing against the wrong hash code.

**tomcloyd** · Jun 11, 2009, 12:22 PM

Re: bit torrent download won't cksum

GreyGeek: I've actually already answered your question as to why I'm confused, in my previous posts. Telengard summarizes in his response.

Telengard: A truly excellent response. Thank you so much. A quick summary response to what you've written:

1. Path to downloads: Let's start over. Beginning at kubuntu.org, and following the obvious path to the download page - at http://www.kubuntu.org/getkubuntu/download, there's a small bittorrent section well down the page. There's no hint anywhere in the page navigation that this section exists. I utterly missed, until now. So...it's on to Google to find where they're hiding those bittorrents, and that how I got to http://torrent.ubuntu.com:6969/. Look at that link. Looks pretty good, eh? That's what I thought. And surely that a cksum string next to the file download link. I mean, what else could it be? You can trust Ubuntu, right? Sure... and here I am..

2. Back to Kubuntu.org's download page, and that little bittorrent section. I click the link, and...in practically no time I have a *.torrent file (27kb) sitting on my hard drive. I've never seen such a thing, and don't know what it is, and if I have some time to read all the instructions not provided at the KB download page I'd surely figure it out. Being simply minded, I just click it. That's the ticket. Bittorrent download starts. Uh...all without any inclining of a cksum to use. Back to Google to find it.

(OK, so #2 did NOT happen, 'cause I used that Ubuntu downloads page, and got myself confused by misreading the page.)

3. "It is damn near impossible to get a corrupted download with bittorrent, assuming your client software and your computer hardware work correctly." Cool. I didn't know that, and in my brief study of bittorrent hadn't seen any such statement. To the contrary, I was wondering how I could trust all those pieces coming from who-knows-where. Hence by great concern about using cksums.

You've done a great deal of work to produce a detailed response to my dilemma, and I've sincerely appreciative for this. Impressive.

Clearly, working from Kubuntu.org to get a bittorrent download, one is provided with inadequate information - no cksum, period. Going to ubuntu to find it - through Google - I found a page that is simply badly designed. No other way to say it. I will take my complaint about this to the proper forum.

Yes, I do trust my bittorent download, and have burned it.

Thanks again.

**Telengard** · Jun 11, 2009, 02:46 PM

Re: <SOLVED> bit torrent download won't cksum

Given that you've never used bittorrent before, and you don't seem to be very familiar with hash codes, your confusion is understandable. I'm just glad I was able to help clear things up for you. Please do continue asking questions when you need help, but don't forget to read the provided documentation as well.

I don't know why the Kubuntu downloads page doesn't link directly to the UbuntuHashes article. IMHO, it definitely ought to because verifying the downloaded file is crucially important. When you lodge your complaint, please do link them to this thread.

Please do always verify every file you download against whatever official checksum you are provided. Even though bittorrent prevents corrupted downloads, it cannot do anything to protect you from tampered (possibly trojan horse) files!

For more information, please see:
HOW TO verify that the Kubuntu ISO file downloaded correctly

**tomcloyd** · Jun 11, 2009, 10:43 PM

Re: <SOLVED> bit torrent download won't cksum

Thanks for the link. That's a fine contribution. The link is going into my note right now. Thanks again for you help!

Announcement

<SOLVED> bit torrent download won't cksum

<SOLVED> bit torrent download won't cksum

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment