Confused by apparent download verification double-up in documentation
In the Trisquel documentation, there is a Download Trisquel page, that includes a section on how to verify that the .iso file wasn't corrupted during download, and confirm that the Trisquel devs were indeed the creators of the downloaded file, using GPG;
https://trisquel.info/en/wiki/download-trisquel#toc4
There's another page, Verify Trisquel Download, describing a process that superficially appears to have the same purpose as'Authenticating the authors', also using GPG;
https://trisquel.info/en/wiki/verify-trisquel-download
The commands involved are different, so I presume it's a different process. But unlike the "verifying" and "authenticating" processes on the Download page, this one is not introduced with any information about its purpose, and how it relates to the processes on Download Trisquel.
This is all a bit confusing to me, and I've been using Trisquel for more than a decade!
Possible fixes (assuming all 3 of the processes described on both page are necessary);
* move all the verification and authentication processes off the download page and onto a unified 'check your download' page, with the processes listed in the order they ought to be carried out, each with a basic intro to its purpose, and a link to a reliable source of newbie-friendly information about it.
* Move the contents of the Verify page to the appropriate place in the Download page, and remove the Verify page from the documentation index
BTW: is sha256sum process strictly necessary if the file has been downloaded using BitTorrent? I presume BT's integrity check would take care of that? If my assumption is correct, it might be good to add a note saying 'if you downloaded the .iso with BitTorrent you can skip this step'.
Thoughts?
The commands involved are different, so I presume it's a different process.
As far as I understand, the only real difference is in the way the public GPG key of trisquel is downloaded:
- from a key server (which requires the sender to confirm her identity, receiving an e-mail, doesn't it?) in https://trisquel.info/en/wiki/download-trisquel#toc5
- from trisquel.info (which may have been compromised: if the ISO was replaced, so could the public key; isn't it the risk calling for the authentication?) in https://trisquel.info/en/wiki/verify-trisquel-download
So, I believe https://trisquel.info/en/wiki/download-trisquel contains the better instruction. Besides the only real difference above, https://trisquel.info/en/wiki/download-trisquel ...
- does not mention older keys, which should not be used anymore;
- asks for less typing, because a single command downloads the key from a key server and import it;
- adapts to any ISO because it uses globbing (* in the shell), rather than specific names;
- instructs to read the output of the verification, what is more "human" than checking the exit status of a command;
- feels better written to me... but I am biased since I did most of the rewriting. :-)
In the end, I think https://trisquel.info/en/wiki/download-trisquel could be kept as it is (but improvements are welcome) and https://trisquel.info/en/wiki/verify-trisquel-download removed (I do not see what it adds but confusion).
Note that SHA512 checksums are available for Trisquel 12. This is probably stronger than the integrity checks provided by BitTorrent clients.
Thanks for those details Magic Banana. I have only a basic understanding of any of this. So having pointed out that this combination of pages is potentially very confusing to a newbie (especially a GNU/Linux newbie), I've probably done all I can. But if there's any way I can help, such as reviewing proposed changes to ensure they're easier to understand, I'm happy to do that. Hit me up here or via the fediverse, or any of the contact info in my profile there (@strypey on the server @mastodon.nzoss.nz).
latenightwake:
> Note that SHA512 checksums are available for Trisquel 12. This is probably stronger than the integrity checks provided by BitTorrent clients
Good to know. However neither of the pages I linked mention SHA512 checksums, so adding instructions on how to use that would be a valuable improvement to the Download Trisquel page.