How important is it to check hashes or PGP/ASC signatures for file integrity?

NotionCommotion · 04-03-2014, 08:45 AM

How important is it check file integrity when downloading a file from the Internet?

Are there some files which are more important to check than others? For instance, downloading initial Linux operating system, downloading Apache, etc?

Also, does checking MD5 or SHA256 hashes perform the same basic task as verifying PGP/ASC signatures?

Thank you

cliffordw · 04-04-2014, 02:04 AM

Hi,

I think it is very important to check the integrity of all files. I've often found corrupt or partial downloads, and these could cause problems if the bad download is not detected. For software downloads, in some cases the problem will manifest itself in other ways early enough, and the installation will fail. In other cases the installation may succeed, but the software may behave in unexpected behaviour, which is very difficult / impossible to troubleshoot.

My 2c :-)

astrogeek · 04-04-2014, 02:20 AM

Quote:

Originally Posted by NotionCommotion

How important is it check file integrity when downloading a file from the Internet?

Only as important as the integrity of your system, data and time are to you.

Quote:

Originally Posted by NotionCommotion

Are there some files which are more important to check than others? For instance, downloading initial Linux operating system, downloading Apache, etc?

No.

Quote:

Originally Posted by NotionCommotion

Also, does checking MD5 or SHA256 hashes perform the same basic task as verifying PGP/ASC signatures?

Thank you

Not exactly. Checking the hashes checks the integrity of the contents of the file. Checking PGP primarily verifies that the file came from the expected source (but also validates file integrity).

NotionCommotion · 04-04-2014, 08:43 AM

Thank you cliffordw and astrogeek,

Just stared doing a new install, and based on your recommendations, I am going to start over and be sure to check every download.