Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've downloaded the Glassfish zip file from and I'd like to verify the integrity of the file, but I can't find any checksums.

Where can they be found?

I've searched the Glassfish website, Google, stackoverflow, superuser and serverfault but haven't found any mention of them.

share|improve this question
Maybe there are none. Why would you need them? Are you having trouble opening the archive? – slhck Sep 20 '11 at 11:28
Which version are you downloading? Full or web profile? Windows or *nix or zip archive? There's a few permutations to resolve here before we can find a reputaqble source of checksums – Rob Cowell Sep 20 '11 at 13:00
@slhck I wanted verification that the file I downloaded was authentic and not corrupt. However, after reading grawity's answer, I now remember that a checksum on its own can't verify the authenticity of a file. I could try the Windows exe and see if that has an embedded signature, but I really wanted the zip version for ease of installation. And there's no guarantee I won't have the same problem as what happened here. – chritohnide Sep 20 '11 at 14:54
@RobCowell I'm downloading the platform-independent zip file for GlassFish Server 3.1.1 Open Source Edition Full Platform – chritohnide Sep 20 '11 at 15:00
I tried downloading the Windows EXE for the same version and profile (glassfish-3.1.1-windows.exe) as the zip, but ran into the issue I've been having with other Oracle signed EXEs - the digital signature did not verify. – chritohnide Sep 20 '11 at 15:06
up vote 1 down vote accepted

The simplest answer – the Glassfish developers don't provide any checksums for download verification, like slhck said – might just be correct.

md5sums and signatures don't come automatically, they have to be created by whoever publishes the files, wasting minutes of their precious coffee-drinking time for very little gain in security (plain MD5 hashes served over insecure HTTP are useless) or integrity (ZIP archives already have CRC32 checksums, the 'sh' installers carry the same ZIP archives, and EXE installers can be self-verifying).

share|improve this answer
It looks like you and slhck might be right. Which brings me to another question... – chritohnide Sep 20 '11 at 15:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .