releng

#11394 Do not release f39 before fixing links to iso checksums - just a tracker
Closed: Invalid by kevin. Opened by augenauf.

Closed: Invalid
Reopen Issue

Couldn't find a release component in bugzilla to propose as blocker bug, but I am posting this here to track the issue

  • Description
    F38 has been released but for spins and labs, there is no working link to the CHECKSUM file despite the website stating that "We take security seriously [...] Once you have downloaded an image, be sure to verify it for both security and integrity. [...] Click the verify button to get instructions tailored for your download." but not provide a working link to the CHECKSUM file is questionable.".
    As of today, the link is 404.

  • How to reproduce
    See https://spins.fedoraproject.org/en/verify

  • When do you need this? (YYYY/MM/DD)
    2023/10/03 Final Freeze

  • If we cannot complete your request, what is the impact?
    Less experienced users won't be able to verify their downloaded iso images

  • Related Docs/Websites issue:
    https://pagure.io/fedora-websites/issue/1174
    https://gitlab.com/fedora/docs/fedora-linux-documentation/release-docs-home/-/issues/4

This is... not something releng can do anything about?

Docs are also not a QE thing... I guess it would need to be proposed to FESCo? Or @bcotton might have better suggestions on where to discuss this?

Metadata Update from @kevin:
- Issue close_status updated to: Invalid
- Issue status updated to: Closed (was: Open)

You're looking for the distribution component in Bugzilla. But this would be rejected as a blocker because it doesn't violate the release criteria. You could be propose it as a final release criterion on the test list. But a pull request to the websites to fix it would probably be a lot simpler. In any case, I agree this is not a releng matter.

OK, thanks for pointing out the details.

I think there is two things here.

One is if, in the future, we want to check if the checksum download is working before Fedora Linux is released - in that case let's create a criterion. Personal opinion: yes we want, because broken links to a checksum file are really bad.

The other is to fix it. I reported the issue 5 months ago. So, either it isn't as easy as we think, or it wasn't given the priority needed.
I am sorry to report that I wasn't able to fix it. (site is here https://gitlab.com/heis2201/fedora-websites-3.0/-/blob/develop/pages/spins/kde/download.vue#L40)

Actually, there is a criterion for the checksum:

https://fedoraproject.org/wiki/Basic_Release_Criteria#Correct_checksums

A correct checksum must be published for each official release image.

I guess we failed to satisfy the criteria since we tried to publish the checksum file but the link was broken...
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.