Verifying Checksum Values with Passport Advantage Downloads

Bill Malchisky  November 5 2013 01:00:00 AM

As we all know, modern software packages tend to be large in size (several hundred megabytes) these days. Add with multiple platform flavors available for each product, pulling down the desired file set can easily venture into several gigabytes. Thus, many sites offer MD5 or SHA values to ensure that the desired target(s) maintain(s) data integrity. Today, in retrieving additional Notes 9.0.1 files, I was reminded once again how IBM provides checksum values.

In the directory where Download Director places your files, there exists a dlmgr.pro file, which contains a significant data about each downloaded file -- including full path to download location, part number, full file name, size, and yes the SHA checksum value. See excerpt example below:

prompt=true
dir=/mnt/hgfs/HostBigData/ibm.software/nd9.0.1
unpackDir=/mnt/hgfs/HostBigData/ibm.software/nd9.0.1
family=esdDownloadV2
.file=CIQ83EN
..title=Swiftfile for IBM Notes 9.0.1 Multiplatform English(CIQ83EN)
..size=7748922
..sha=86579FA092CD559E782DC69E4570BBDB5D988770
..stat=1
..name=SWIFTFILE_FOR_NOTES_9.0.1_MP_EN.zip
..path=/mnt/hgfs/HostBigData/ibm.software/nd9.0.1
..unpack=1
..crc=
..date=1382433157
.file=CIQ7TEN
..title=IBM Notes Client V9.0.1 for Linux (Debian Install) English(CIQ7TEN)
..size=522844160
..sha=97AB704E4EED33D18DD7D1E02AD4F2C04EE01706
..stat=1
..name=NOTES_9.0.1_LINUX_DI_EN.tar
..path=/mnt/hgfs/HostBigData/ibm.software/nd9.0.1
..unpack=2
..crc=
..date=1382625362

You can also see that each new entry commences with a single decimal point, and correlated data is prefaced by two decimal points, for easy parsing.

Tip
Another nice feature of the dlmgr.pro file is that it pre-populates the file immediately before pulling the first file. Thus, if the connection is interrupted, you can see what you selected, the respective part numbers (to avoid searching again) -- handly if you missed anything during a browser crash. As a reesult, you can just go back and select the partial files easily. I find it can save some valuable time over looking for part numbers in arrears later.


Verifying Checksums: In the first example, let's look to see if my pulled Swiftfile bundle has data integrity.

Linux
1. Open a terminal window
2. $ cd {path/to/file}
3. $ shasum SWIFTFILE_FOR_NOTES_9.0.1_MP_EN.zip
Optional: shasum -b SWIFTFILE_FOR_NOTES_9.0.1_MP_EN.zip --> you can include the "-b" parameter to force the program to read from a binary file

Output Verification
86579fa092cd559e782dc69e4570bbdb5d988770 *SWIFTFILE_FOR_NOTES_9.0.1_MP_EN.zip

Looking at the sha=8657... line above, you can see that downloaded Swiftfile target is correct and is safe to use, as the values match.

If you lack a Linux toolset at your disposal (which includes Cygwin) you can perform the same maneuver on Mac or Windows, albeit a bit more complex with the latter.


Mac
1. Same exact steps as on Linux above.


Windows
1. For Microsoft Windows, no such native tool is available
2. Open your web browser
3. Search for Windows {version} shasum tool
4. Visit a trusted site and download the file
4a. Example: Via GnuPG servers -- ftp://ftp.gnupg.org/gcrypt/binary/sha1sum.exe by Werner Koch (wk at gnupg.org )
4b. Try HashTab (free for personal; $10 for at work usage) click here
4c. Notation: Microsoft offers an unsupported tool via their website for Windows 2000, XP --> click here
"Warning The Microsoft File Checksum Integrity Verifier tool is an unsupported command line utility that computes MD5 or SHA1 cryptographic hashes for files. " --Microsoft
4d. Notation: Microsoft's TechNet Gallery offers a Lotus Sandbox type contribution for Windows 7 and Windows 8 via PowerShell here
4e. Notation: As the PowerShell tool simply wraps the original unsupported MS tool, it should be viewed also as unsupported
5. Execute your chosen program from a command prompt window or desktop as appropriate
6. Navigate to the file's directory
7. If using the GnuPG tool, type: sha1sum SWIFTFILE_FOR_NOTES_9.0.1_MP_EN.zip
7a. Else, follow your tool's directions for the correct command line executable name
8. Verify results

--OR--
Install Cygwin and then run with the Linux directions above

Finally, there exist Perl extensions so you can write your own tool, if you would like to do so.

• Comments [0]