#1174 Dead link on https://spins.fedoraproject.org/en/verify
Closed: complete 5 months ago by augenauf. Opened 10 months ago by augenauf.

In section How do I verify my downloaded image on another operating system?, there is a link to Fedora Docs (Read these instructions to verify your image). That links leads to a 404.


The verify your download instructions for the latest KDE spin (and most likely all Spins downloads) point to the wrong location for the gpg key. Also you have to dearmor the gpg key before you can import it due to binary encoding of the file. You also cannot download the checksum file due to the same issue of it not being located in the same place any more, the checksum is now located at https://download.fedoraproject.org/pub/fedora/linux/releases/38/Spins/x86_64/iso/Fedora-Spins-38-1.6-x86_64-CHECKSUM

In my opinion, this should have been a relase blocking bug. violation of "A correct checksum must be published for each official release image.", see https://fedoraproject.org/wiki/Basic_Release_Criteria#Correct_checksums

Stating "We take security seriously Once you have downloaded an image, be sure to verify it for both security and integrity. [...] Click the verify button to get instructions tailored for your download." on one hand but not providing a working link to the CHECKSUM file on the other hand is questionable.

Metadata Update from @augenauf:
- Issue close_status updated to: complete
- Issue status updated to: Closed (was: Open)

5 months ago

Login to comment on this ticket.