MX-23.2_KDE_x64.iso checksum mismatch?

[Innuendo]

Hi,
Can one of the devs confirm the checksum for the KDE torrent below is correct? I keep getting a mismatch...


$ sha256sum MX-23.2_KDE_x64.iso
9c41a724ec49c307c8f9229f33f38d5833922b1d9e202a269f1162b8f4252936 MX-23.2_KDE_x64.iso

$ cat MX-23.2_KDE_x64.iso.sha256
e318809374e8f07ab259385b6f6ad85fb5be8e941fd7057b4fdf088a4f6ac479 MX-23.2_KDE_x64.iso


cat MX-23.2_KDE_x64.iso.md5
84cbc3f6516d70849288cbd8f88b1022 MX-23.2_KDE_x64.iso

$ md5sum MX-23.2_KDE_x64.iso
5f89859e53f4eb8b62620cd5dffad966 MX-23.2_KDE_x64.iso

[dolphin_oracle]

the published md5 is correct, and matches what sourceforge calculates. I presume the sha256 is correct as well, but I did not check it.

[Innuendo]

Thank you for the quick response.
I'll wait a while then on the KDE download then. The torrent seems to be corrupted.

[popjah]

Same thing happened to me, but on booting the MX-23.2_ahs_x64 iso I chose the self-check option and it gave a 100% result, so I went ahead and installed the system and everything is OK.

[fehlix]

Here how it should look like:
The checksums:

Code: Select all

head MX-23.2_KDE_x64.iso.md5 MX-23.2_KDE_x64.iso.sha256 
==> MX-23.2_KDE_x64.iso.md5 <==
84cbc3f6516d70849288cbd8f88b1022  MX-23.2_KDE_x64.iso

==> MX-23.2_KDE_x64.iso.sha256 <==
e318809374e8f07ab259385b6f6ad85fb5be8e941fd7057b4fdf088a4f6ac479  MX-23.2_KDE_x64.iso

The check:

Code: Select all

md5sum -c MX-23.2_KDE_x64.iso.md5 
MX-23.2_KDE_x64.iso: OK

sha256sum -c MX-23.2_KDE_x64.iso.sha256
MX-23.2_KDE_x64.iso: OK

The signature check:

Code: Select all

TZ=America/New_York gpgv MX-23.2_KDE_x64.iso.sig MX-23.2_KDE_x64.iso 
gpgv: Signature made Sun 21 Jan 2024 03:24:38 PM EST
gpgv:                using RSA key F27753A18E92E3937E6335E770938C780679EE98
gpgv: Good signature from "Adrian <adrian@mxlinux.org>"

The KDE iso's found on that torrent are the one's which should not have been published,
b/c the have been build one day earlier as a pre-release/sanity-check type of build:

These are the checksums and the signatue-check of the KDE iso build one day before:

Code: Select all

head MX-23.2_KDE_x64.iso.md5 MX-23.2_KDE_x64.iso.sha256 
==> MX-23.2_KDE_x64.iso.md5 <==
5f89859e53f4eb8b62620cd5dffad966  MX-23.2_KDE_x64.iso

==> MX-23.2_KDE_x64.iso.sha256 <==
9c41a724ec49c307c8f9229f33f38d5833922b1d9e202a269f1162b8f4252936  MX-23.2_KDE_x64.iso

md5sum -c MX-23.2_KDE_x64.iso.md5 
MX-23.2_KDE_x64.iso: OK
sha256sum -c MX-23.2_KDE_x64.iso.sha256
MX-23.2_KDE_x64.iso: OK

The signature check:

Code: Select all

TZ=America/New_York gpgv MX-23.2_KDE_x64.iso.sig MX-23.2_KDE_x64.iso 
gpgv: Signature made Sat 20 Jan 2024 01:09:07 AM EST
gpgv:                using RSA key F27753A18E92E3937E6335E770938C780679EE98
gpgv: Good signature from "Adrian <adrian@mxlinux.org>"

So it looks like the pre-release made it onto the torrents.
Maybe, the files on the torrent servers should be updated to avoid people getting confused.
Attn: @dolphin_oracle / @timkb4cq

[dolphin_oracle]

yep, just found the same.

pretty sure the Xfce and KDE isos are affected. the fluxbox and pi repsin are OK.

the only difference should be the updated installer that was pushed at the last minute.

while we sort it out, the self check on the boot and in the installer should still verify the iso integrity.

I disabled downloading torrent files from the website, but tim will need to fix the torrent files themselves.

[Jak]

The Xfce 64 iso I downloaded via torrent on 2024-01-25t23:03z was also wrong:

Code: Select all

3b222f8a7c2bf97e46945db910200ff55a00a631318b4068351599a300311163 MX-23.2_x64.iso

compared to what's in MX-23.2_x64.iso.sha256:

Code: Select all

968f9d6b01bb966cac025b6971cdcdb9dad39bb74a2600162f9f4bd7e6ab9eae MX-23.2_x64.iso

The MX-23.2_x64.iso.torrent linked from https://mxlinux.org/torrent-files/ is still the same 2024-01-21t18:51:33 file as the one I used to download the wrong .iso.
When fixed, can the links and filenames at https://mxlinux.org/torrent-files/ include the new date in RFC3339 format to show it's different?

[Jak]

I've verified with sha256sum that the correct iso is now available when using the new 2024-01-26t14:58:46 MX-23.2_x64.iso.torrent file.

I see that the AHS torrent file has also been updated, but I didn't test it.
The KDE torrent file was updated on 2024-01-23.

Many thanks.