Checking file hash from virtio iso?

[tt01x]

Hello,

How I can check file hash from virtio iso?

From proxmox wiki (https://pve.proxmox.com/wiki/Windows_VirtIO_Drivers):

Using the ISO​

You can download the latest stable (https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/stable-virtio/virtio-win.iso)

 

[bbgeek17]

How I can check file hash from virtio iso?

That depends on the hash type that you are comparing against: md5, sha, etc.

---

Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox

 

[tt01x]

That depends on the hash type that you are comparing against: md5, sha, etc.

---

Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox

Thank you for your answer.

My question was poorly written, I can see that know.

I can of course check the hash (comparing against md5 or sha256) from the iso file, but I can't know is that hash correct, because I don't see checksum on proxmox wiki. How I can be sure my iso file is correct after have I downloaded it?

 

[bbgeek17]

but I can't know is that hash correct, because I don't see checksum on proxmox wiki. How I can be sure my iso file is correct after have I downloaded it?

Proxmox wiki points to an external resource. That resource is not maintained by PVE in any way. If that resource does not provide the means to ensure the file was not tampered with, I guess you just have to trust it. On the other hand if you think that the website that provides ISO is compromised, then I dont think you can trust the hash either...

---

Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox

 

[bbgeek17]

Looking at the repo file https://fedorapeople.org/groups/virt/virtio-win/:

[virtio-win-latest]
name=Latest virtio-win builds
baseurl=https://fedorapeople.org/groups/virt/virtio-win/repo/latest
enabled=0
skip_if_unavailable=1
gpgcheck=0

Since no signed GPG key is provided and gpg check is disabled, the only way to be 100% certain is to download the source, ensure it contains no backdoors/etc and build your own... Somewhat time consuming.

---

Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox

 

[tt01x]

Proxmox wiki points to an external resource. That resource is not maintained by PVE in any way. If that resource does not provide the means to ensure the file was not tampered with, I guess you just have to trust it. On the other hand if you think that the website that provides ISO is compromised, then I dont think you can trust the hash either...

---

Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox

This true, thank you. I was hoping if someone knows where to find the checksum, even though it's from external resource.

 

[tt01x]

Looking at the repo file https://fedorapeople.org/groups/virt/virtio-win/:

[virtio-win-latest]
name=Latest virtio-win builds
baseurl=https://fedorapeople.org/groups/virt/virtio-win/repo/latest
enabled=0
skip_if_unavailable=1
gpgcheck=0

Since no signed GPG key is provided and gpg check is disabled, the only way to be 100% certain is to download the source, ensure it contains no backdoors/etc and build your own... Somewhat time consuming.

---

Blockbridge : Ultra low latency all-NVME shared storage for Proxmox - https://www.blockbridge.com/proxmox

I think I will trust that this file is not tampered with. I would think almost everyone who installs Windows VM on proxmox will download this iso file and install drivers and qemu agent. Thank you bbgeek17 for you answers.