Sha1 Checksum incorrect on download
Microsoft MS-DOS 3.30 (5.25-360k) (download url: https://winworldpc.com/download/c2a9c3a8-c692-c3bb-3950-11c3a5c290ef) shows a sha1 checksum of c3afe280a134c2a0c2b43a415c0cc2b2c2bdc3a2 on the web site but when I download it, I come up with: ef8734a0b43a415c0cb2bde2d1fa50dd63d7d98c. I checked several of the other downloads on that same page and all of them are a mismatch.
I saw another report of the Windows 3.11 checksums being mismatched as well, so I checked a couple of other files (OS/2, PC-MOS) and none of the hashes matches when the files are downloaded.
I can't swear that all of the files have mismatching sha1 hashes, but I have now tried 16 files and none of them came up with a match.
Thanks, GregSS
Comments
Update -- I checked 3 files in the Applications download section and all 3 of them are correct. Maybe it is only the OS section of the downloads.
Thanks, GregSS
This is a known issue. Some of the SHA1 checksum values got messed up in the database at some point. The files are fine though.
I wonder if it might be good to temporarily disable displaying checksums until this is fixed in the database. There's no point in using them if they're incorrect and I think it reflects poorly on the quality of the library.
SomeGuy, I thought that might be the case, but, better safe than sorry. I copied one of the downloads and with a little free time unpacked the files in a VM and compared them with Beyond Compare to be sure all the files were the same and they were good so I have complete confidence in the rest of the downloads.
Thanks!,
GregSS
https://winworldpc.com/download/2a5bc388-0d3e-0311-c3a6-e280947e5254 EZ-SCSI v5.0 ISO SHA1 and file size incorrect. Downloaded from Julian, France and Ricky, Germany and got the same SHA1: ef6d0b2b078c540ec35cbd444e748aecee30c904
from both. Hope this helps somebody.
There is a known problem with the SHA1 values in the WW database. Those need to be regenerated sometime. The SHA1 value you posted matches my local copy.
Suggestion: rather than having users or admins generating SHA1 hashes locally, we should:
1. have Adventure or the mirror servers automatically generate the SHA1 on upload
2. have the system periodically verify that the file on the servers matches the generated SHA1 in the DB
3. If they do not match, it should label the affected files as "Potentially Bad", with an explanation like "This file may have errors. It may not work properly." and notify an admin.
This should mitigate the problem you're talking about.
The SHA1 checksum for https://winworldpc.com/download/c3bdc5be-c3b0-e280-a631-c2a611c3a4ef does not match the downloaded file.
Could someone please confirm what the correct SHA1 checksum for this file should be?
I don't want to risk installing a software that might have been tampered with...
Thank You!