Current web site with link to installation media (https://fedoraproject.org/en/get-fedora or https://fedoraproject.org/en/get-fedora-options) does not provide cryptographic signatures necessary to verify integrity.
There is only a link ''Verify Download'' six sections underneath which is to far.
I propose following improvement:
Put link to signature right next to shiny Download links. If the datails about size are important enough, a link to signature could be there too. Like:
{{{ Download Now! 605MB, ISO format image for Intel-compatible PCs (32-bit), signature }}}
Where the ''signature'' label would point to to /pub/fedora/linux/releases/16/Live/i686/Fedora-16-i686-Live-CHECKSUM.
See [http://permalink.gmane.org/gmane.linux.redhat.fedora.devel/160387 fedora-devel maling list] for discussion.
Hi, If we need to increase the visibility of the signature and checksum, adding a "verify" link to "/verify" would be better I think than linking to the CHECKSUM file.
Better to provide instructions than raw data as gurus already know how to verify the media and should know where to grab the CHECKSUM file.
If we add instructions to verify the iso (checksum or signature), why don't we provides better instructions for burning a Live USB dongle, and co? The less content we have, the more efficient they find it.
I would agree to add the "verify" link on the get-fedora near the file size. About get-fedora-options, get-fedora-options#formats, spins.fpo… That could be too much.
You still not get the idea. The problem I'm pointing is finding the signature is hard.
E.g. /get-fedora-options lists ''Fedora 16 Desktop Edition'' to download, but none label on /verify page does match the label from get-page. Even the categorization is different. Thus I think direct link to relevant check-sum would be helpful.
If you still persist on linking the same howto at each image, please mirror the structure from get-pages.
We will have this on the new webpages, which will be in production at F21 final release.
Login to comment on this ticket.