I am marking this critical because it is either a major mistake or the server has been compromised. $ wget -S -c 'http://mirrors.us.kernel.org/gentoo//releases/x86/20121221/livedvd-x86-amd64-32ul-20121221.iso' [...] 2012-12-21 20:58:58 (232 KB/s) - ‘livedvd-x86-amd64-32ul-20121221.iso’ saved [4103079936/4103079936] [...] $ dog livedvd-x86-amd64-32ul-20121221.iso.DIGESTS # MD5 HASH b83fde344c7231e7946b1541198a56cd livedvd-x86-amd64-32ul-20121221.iso 23cd450773806f9cc79164c4b3eeeec7 livedvd-x86-amd64-32ul-20121221.iso.CONTENTS 7310d5e025fc9202bd58a581be53befe livedvd-x86-amd64-32ul-20121221.iso.CONTENTS-squashfs.gz 64cda8d78c1b2eff4a53226dbb21a3ed livedvd-x86-amd64-32ul-20121221.iso.PACKAGES 38f0954203934175f751fe15ab80891c livedvd-x86-amd64-32ul-20121221.iso.CREDITS # SHA1 HASH 602030605540d03d9814805311971cd7f5eeca46 livedvd-x86-amd64-32ul-20121221.iso e8ff5cf6dfb26ba5ef7c434366de92ee0f088ddd livedvd-x86-amd64-32ul-20121221.iso.CONTENTS 8f21f09b5ec1b3667a97aaf170e4414216634d43 livedvd-x86-amd64-32ul-20121221.iso.CONTENTS-squashfs.gz c885591f5339a15dfa779cf69fbc1dca0c95e79e livedvd-x86-amd64-32ul-20121221.iso.PACKAGES 8ef4fb0cb07d69be624f5f66aa5a0f0717b2ee20 livedvd-x86-amd64-32ul-20121221.iso.CREDITS # SHA512 HASH 4cd389fe5e8616fbb7a6d5eb6a717a7624b8e8750ae0c800014b7703ed9254b3d5fab7136373d23333da4d9168edbba0e93758ce68ba5e7f5341dea2a052f4ad livedvd-x86-amd64-32ul-20121221.iso 753d91d99657bc35a20775d7f6dccd799fddc3a27608d52276c5a9af16b8307267759e2db2d84bc39542805f80896bce33c1623857e318f1d60354b78264f393 livedvd-x86-amd64-32ul-20121221.iso.CONTENTS 31c5d00b2e490357275f6f767e1e9f8711df41fb4a994f29ddba846f404f6eaf4e919c859ce45f2dc182ca78999339aec2c28b36dfeb3ae515def15684f43368 livedvd-x86-amd64-32ul-20121221.iso.CONTENTS-squashfs.gz d0f0b96771e95b11679abed9089db60a60b70475665de408718af2537e7fa735edc7a47606183545c7b397162c09f792d8f763d5a3aba79f47a7c88cc599cab1 livedvd-x86-amd64-32ul-20121221.iso.PACKAGES de602df31e51aa5388b70ffee306f51746231ff29aa17ca1fd489975008e42ac25c9c3ed46ad8df4547c1d59f4ca6450796d411f82e719b9f0c00bf47ea0b259 livedvd-x86-amd64-32ul-20121221.iso.CREDITS # WHIRLPOOL HASH c01076cedd84d9cafad5b460ceb80342bd027cfbeed034fe7f77ef1ab2971058d99017b7571b1004b7fbe0dfe433244a15b8f6a081bdc9e2ffc4df941bce8df4 livedvd-x86-amd64-32ul-20121221.iso.CONTENTS 3a9062c258e9020eb568f7ee1045c3ad681cb770837a78faf2167bb94d395b78c0d8ff82cbb8f9b5cb42bfd31e6ea3c83d49c429f7e629e5948fa72369cd46a7 livedvd-x86-amd64-32ul-20121221.iso.CONTENTS-squashfs.gz 3e3cca1cd8cc881ddb55f3906acb2aad8d76eeea6afe869fc0546547b02f216e0e24b7f82d3b94bce522335e030cdc2a4be85c49e06183a91ed2a9dc87c362c7 livedvd-x86-amd64-32ul-20121221.iso.PACKAGES 5abd4e297a7e2f803e513bde9bb09c12be62731eb700f22fba39987c3bd7d155824170e0deac675c3dba020551ca14c838a4ca99359a220ee8c5bef94b895dbb livedvd-x86-amd64-32ul-20121221.iso 906953437014cbc79ed20b5e18314e4d729bd45f35aaf9327d71ebc2c83d738c7ae0edcc5ec41471f3be9f8d3d9a40c49e3af16dce3ac47eeba633df98083986 livedvd-x86-amd64-32ul-20121221.iso.CREDITS $ sha1sum livedvd-x86-amd64-32ul-20121221.iso c9c07179c949330bc3b399765e35d5cf5e28a380 livedvd-x86-amd64-32ul-20121221.iso (just in case there was some strange glitch): $ rsync -acvz --inplace --progress rsync://mirror.mcs.anl.gov/gentoo/releases/x86/20121221/livedvd-x86-amd64-32ul-20121221.iso livedvd-x86-amd64-32ul-20121221.iso receiving incremental file list sent 31 bytes received 110 bytes 0.84 bytes/sec total size is 4103079936 speedup is 29099857.70 $ md5sum livedvd-x86-amd64-32ul-20121221.iso f44b4f0a7071d0b16f8035209082e09e livedvd-x86-amd64-32ul-20121221.iso $ sha1sum livedvd-x86-amd64-32ul-20121221.iso c9c07179c949330bc3b399765e35d5cf5e28a380 livedvd-x86-amd64-32ul-20121221.iso $ sha512sum livedvd-x86-amd64-32ul-20121221.iso 6d0ef2f1694f5c0424822f59e001a418b9d0c8520a44482cb8fea367439f65d01d1bdcce00c365fee3f505e3bb11060f4f8953d198c46d6d5008d806e4745d42 livedvd-x86-amd64-32ul-20121221.iso Obviously, I will not be using this image until the verification issue is resolved.
I'm checking it.
From the masterreleases box, I think some corruption crept into the one ISO, I'm trying to figure out why. $ f=livedvd-amd64-multilib-20121221.iso.DIGESTS.asc ; gpg --verify $f && sha1sum -c $f gpg: Signature made Fri Dec 21 02:07:11 2012 UTC using DSA key ID 17072058 gpg: Good signature from "Gentoo Linux Release Engineering (Gentoo Linux Release Signing Key) <releng@gentoo.org>" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: D99E AC73 79A8 50BC E47D A5F2 9E64 38C8 1707 2058 livedvd-amd64-multilib-20121221.iso: OK livedvd-amd64-multilib-20121221.iso.CONTENTS: OK livedvd-amd64-multilib-20121221.iso.CONTENTS-squashfs.gz: OK livedvd-amd64-multilib-20121221.iso.CREDITS: OK livedvd-amd64-multilib-20121221.iso.PACKAGES: OK sha1sum: WARNING: 25 lines are improperly formatted $ f=livedvd-x86-amd64-32ul-20121221.iso.DIGESTS.asc ; gpg --verify $f && sha1sum -c $f gpg: Signature made Thu Dec 20 23:39:09 2012 UTC using DSA key ID 17072058 gpg: Good signature from "Gentoo Linux Release Engineering (Gentoo Linux Release Signing Key) <releng@gentoo.org>" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: D99E AC73 79A8 50BC E47D A5F2 9E64 38C8 1707 2058 livedvd-x86-amd64-32ul-20121221.iso: FAILED livedvd-x86-amd64-32ul-20121221.iso.CONTENTS: OK livedvd-x86-amd64-32ul-20121221.iso.CONTENTS-squashfs.gz: OK livedvd-x86-amd64-32ul-20121221.iso.PACKAGES: OK livedvd-x86-amd64-32ul-20121221.iso.CREDITS: OK sha1sum: WARNING: 25 lines are improperly formatted sha1sum: WARNING: 1 computed checksum did NOT match
Ok, that one iso ended up with a copy of the checksums appended at the end, probably me fat-fingering it when I was signing the digest. It's exactly 2048 bytes too large, and that single 2k of data just has checksums. If you want to fix it without redownloading: # truncate -s 4103077888 livedvd-x86-amd64-32ul-20121221.iso The mirror copy has been fixed.
*** Bug 448144 has been marked as a duplicate of this bug. ***
