Mailing-List: contact flex-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: flex-dev@incubator.apache.org
Date: Wed, 1 Aug 2012 14:06:05 +0000 (UTC)
From: "Erik de Bruin (JIRA)" <jira@apache.org>
To: flex-dev@incubator.apache.org
Message-ID: <631205006.785.1343829965156.JavaMail.jiratomcat@issues-vm>
In-Reply-To: <1200279506.117150.1343672735667.JavaMail.jiratomcat@issues-vm>
Subject: [jira] [Updated] (FLEX-33150) Progamatically verify the MD5 hash of
 the downloaded Apache Flex SDK
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


     [ https://issues.apache.org/jira/browse/FLEX-33150?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Erik de Bruin updated FLEX-33150:
---------------------------------

    Attachment: InstallApacheFlex_Patch_EdB_MD5_2012-08-01.txt

I've created a utility class that reads the Flex SDK archive MD5 hash from 'apache.org', calculates the hash of the local (downloaded) archive and compares these. I've used the MD5Stream class mentioned on the dev list, working on a FileStream of the local archive. The class clones and re-dispatches the progress event of the FileStream to facilitate feedback to the user (read the 'note' below ;-)).

I've added some code to embed the new class in the main application, but I'm sure that needs more work.

Note: the calculation of the hash of the local file (66+ MB) takes a long, long time (> 150 seconds on my quad core 2.2 GHz Intel Core i7), so we might want to make this an optional feature, with a default of "don't try this at home, kids..."
                
> Progamatically verify the MD5 hash of the downloaded Apache Flex SDK
> --------------------------------------------------------------------
>
>                 Key: FLEX-33150
>                 URL: https://issues.apache.org/jira/browse/FLEX-33150
>             Project: Apache Flex
>          Issue Type: Sub-task
>            Reporter: OmPrakash Muppirala
>            Assignee: Bertrand Delacretaz
>            Priority: Blocker
>         Attachments: InstallApacheFlex_Patch_EdB_MD5_2012-08-01.txt
>
>
> >>>4.  The installer app needs to programatically verify the downloaded
> >>>flex
> >> >binaries' signatures.  I have very little experience with crypto
> >> >algorithms.  Can someone take this up?  Even if someone can explain the
> >> >steps to do this, I can get it done.
> >>
> >> Are you going to check the signature (.asc) or the checksum (.md5)?  I'm
> >> sure the later is much easier.
> >>
> >>
> >.md5 it is, then ;-)  As I said, I dont know how to go about doing this
> >(yet)  I will do some research on this when I get a chance.
> It looks like com.adobe.com.crypto.MD5Stream in
> https://github.com/mikechambers/as3corelib will do what you need.  It has
> a BSD license so we can use it with no issues.
> Mail discussion thread:
> http://markmail.org/message/czqpeetkjart3ei6

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira