up vote 0 down vote favorite
share [g+] share [fb]

I've downloaded the Glassfish zip file from http://glassfish.java.net/downloads/3.1.1-final.html and I'd like to verify the integrity of the file, but I can't find any checksums.

Where can they be found?

I've searched the Glassfish website, Google, stackoverflow, superuser and serverfault but haven't found any mention of them.

link|improve this question
Maybe there are none. Why would you need them? Are you having trouble opening the archive? – slhck Sep 20 '11 at 11:28
Which version are you downloading? Full or web profile? Windows or *nix or zip archive? There's a few permutations to resolve here before we can find a reputaqble source of checksums – Rob Cowell Sep 20 '11 at 13:00
@slhck I wanted verification that the file I downloaded was authentic and not corrupt. However, after reading grawity's answer, I now remember that a checksum on its own can't verify the authenticity of a file. I could try the Windows exe and see if that has an embedded signature, but I really wanted the zip version for ease of installation. And there's no guarantee I won't have the same problem as what happened here. – SlaY3R Sep 20 '11 at 14:54
@RobCowell I'm downloading the platform-independent zip file for GlassFish Server 3.1.1 Open Source Edition Full Platform – SlaY3R Sep 20 '11 at 15:00
I tried downloading the Windows EXE for the same version and profile (glassfish-3.1.1-windows.exe) as the zip, but ran into the issue I've been having with other Oracle signed EXEs - the digital signature did not verify. – SlaY3R Sep 20 '11 at 15:06
show 2 more comments
feedback

1 Answer

up vote 1 down vote accepted

The simplest answer – the Glassfish developers don't provide any checksums for download verification, like slhck said – might just be correct.

md5sums and signatures don't come automatically, they have to be created by whoever publishes the files, wasting minutes of their precious coffee-drinking time for very little gain in security (plain MD5 hashes served over insecure HTTP are useless) or integrity (ZIP archives already have CRC32 checksums, the 'sh' installers carry the same ZIP archives, and EXE installers can be self-verifying).

link|improve this answer
It looks like you and slhck might be right. Which brings me to another question... – SlaY3R Sep 20 '11 at 15:44
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.