1661068 - Figure out a way to handle checksums and attribution on archive.m.o

Status: NEW

(Release Engineering :: Release Automation: Other, enhancement)

Description

[Mike Kaply [:mkaply]]

Currently we provide checksums for the builds on archive.m.o

Those checksums are only valid for builds on the actual site.

If you download a build via https://www.mozilla.org/en-US/firefox/new/, because the build is marked with our attribution, the checksum from the website isn't valid.

Adding checksums for all attributed files seems unlikely, so maybe we can add a readme or something like that? Or get rid of checksums? A contributor suggested this:

=====

These checksums correspond only to the builds in these directories.

Builds that are downloaded from other locations are different, include
attributions such as [[include an example here of the purpose of an
attribution]], and do not have checksums.

The proper way to verify Mozilla builds is to verify their digital
signatures, which can be accomplished in your file manager and in
dedicated signature verification applications.

For more details: [[Include a link here to a relevant Mozilla web page
if one exists.]]

=====

The filename could be something like "Checksum notice.txt".

Comment 1

[Johan Lorenzo [:jlorenzo]]

The proposed approach seems valid to me. What's your opinion on adding such a notice file, :bhearsum?

Comment 2

[[e-mail] (:bhearsum)]

I don't see any downside!