Re: Re: Re: Re: package.xml: md5sum attribute of <file />

On Tue, Nov 25, 2003 at 07:47:31AM +0100, Roman Neuhauser wrote: > > The emphasis is on "individual". The manifest is the package.xml > > file, which is stored in and distributed with the package archive. > > Therefore, the package.xml file can have no knowledge of the overall > > integrity of the package archive, but it can verify that the > > individual files are valid based on their MD5 checksums. > > So again: > > 1. what practical benefit does checksumming individual files > provide over whole-package checksums? It allows the Installer to validate each file as its installed, to guard against any archive extraction errors. > 2. why do(es) checksum(s) have to reside inside package.xml? That's the only place they can reside in the archive. Otherwise, the Installer would have to query pear.php.net (or similar) to get the checksums (i.e. it makes the archive standalone). -- Jon Parise (jon@php.net) :: The PHP Project (http://www.php.net/)