<div dir="auto">Thanks​ for the suggestions, I will check it once again and let you know.</div><div class="gmail_extra"><br><div class="gmail_quote">On 25-Jan-2018 8:00 PM, "Peter Schober" <<a href="mailto:peter.schober@univie.ac.at">peter.schober@univie.ac.at</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">* Satheesh Kumar <<a href="mailto:satheeshvsbk@gmail.com">satheeshvsbk@gmail.com</a>> [2018-01-25 14:57]:<br>
> We are upgrading Shib SP 2.6.0 to 2.6.1, while doing so I downloaded the<br>
> "xml-security-c-1.7.3" from the apache site -<br>
> <a href="http://santuario.apache.org/download.html" rel="noreferrer" target="_blank">http://santuario.apache.org/<wbr>download.html</a> and did md5sum to verify its<br>
> integrity. But it seems the md5 checksum and the signature provided in the<br>
> apache site is different, below is the md5 checksum values<br>
><br>
> MD5 (xml-security-c-1.7.3.tar.gz) = *<wbr>481a0f29d1b6e898da79f80dbbf7b0<wbr>5b*<br>
> apache MD5 link<br>
> <<a href="https://www.apache.org/dist/santuario/c-library/xml-security-c-1.7.3.tar.gz.md5" rel="noreferrer" target="_blank">https://www.apache.org/dist/<wbr>santuario/c-library/xml-<wbr>security-c-1.7.3.tar.gz.md5</a>><br>
><br>
> md5sum xml-security-c-1.7.3.tar.gz *<wbr>1fe1ff8cb30e614e717c3a0a52f179<wbr>bc*<br>
><br>
> Kindly let me know where I can download the above tar file which is tamper<br>
> free or can I go ahead and use this tar file, I think its source code is<br>
> changed.<br>
<br>
I doubt the Shibboleth list is the right forum for this (even though<br>
Scott may act as maintainer for that Apache project, too) but<br>
anyway -- this works fine for me:<br>
<br>
$ curl -sSOL "<a href="http://www.apache.org/dist/santuario/c-library/xml-security-c-1.7.3.tar.gz{,.md5}" rel="noreferrer" target="_blank">http://www.apache.org/dist/<wbr>santuario/c-library/xml-<wbr>security-c-1.7.3.tar.gz{,.md5}</a><wbr>"<br>
<br>
$ md5sum -c xml-security-c-1.7.3.tar.gz.<wbr>md5<br>
xml-security-c-1.7.3.tar.gz: OK<br>
<br>
$ cat xml-security-c-1.7.3.tar.gz.<wbr>md5<br>
MD5 (xml-security-c-1.7.3.tar.gz) = 481a0f29d1b6e898da79f80dbbf7b0<wbr>5b<br>
<br>
But of course:<br>
<br>
* MD5 shouldn't be used anymore at all<br>
<br>
* Those checkums are meant to easily identify broken downloads, they<br>
  do not authenticate the software: Whoever may have broken into the<br>
  Apache or their mirror servers to replace the software will<br>
  also be able to replace those checkums.<br>
<br>
* If you want to authenticate the software use PGP, as is written in<br>
  several places on that Apache site, including in section:<br>
  "VERIFY THE INTEGRITY OF THE FILES" at<br>
  e.g. <a href="http://www.apache.org/dyn/closer.lua/santuario/c-library/xml-security-c-1.7.3.tar.gz" rel="noreferrer" target="_blank">http://www.apache.org/dyn/<wbr>closer.lua/santuario/c-<wbr>library/xml-security-c-1.7.3.<wbr>tar.gz</a><br>
<br>
-peter<br>
--<br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br>
</blockquote></div></div>