SHA256 checksums only available after downloading

• Feb 9, 2019 - 14:26
Reported version
3.0
Type
musescore.org
Frequency
Few
Severity
S5 - Suggestion
Reproducibility
Always
Status
active
Regression
Yes
Workaround
Yes
Project
MuseScore

The Sourceforge-based downloads offered various checksums for downloadable packages as per this forum post https://musescore.org/en/node/43896
Currently we are offered a SHA256 checksum after starting a download. If you do not make a note of this checksum, the only way to get it, is to start the download again.

There are no centrally accessible checksums on the the FTP site,
https://ftp.osuosl.org/pub/musescore/releases/MuseScore-3.0.2/

Usage cases
1) Users can verify the checksums when downloading from the ftp site.
2) The maintainers of 3rd party installers that use the official binaries like

Homebrew (for macOS) (via Homebrew Cask) and
Scoop (for Windows) (via Scoop Extras)
can get the checksums for the new version without having to download that version.

Regression: Since older hosting sites included a checksum

Workaround: Download the installer, run sha256sum / shasum -a 256 against the file, or get the sha256sum off the "Thank you" page after starting a download.

Comments

• Feb 9, 2021 - 18:21
Status fixed ⇒ active

This is unfortunately not fixed. What was fixed was a discrepancy between the macOS reported sha256sum download for 3.6.1, and the actual sha256sum. There is still no way to the get all downloadable files’ sha256sums without starting the download for each and and getting to the “Thank you for downloading MuseScore” page.

Reply