MD5 mismatch on my 12.04 ISO, what is going on?

Question

I downloaded ubuntu-12.04-desktop-amd64.iso from http://releases.ubuntu.com/precise/

This page also has a link to file showing the respective MD5 hashes for each file

The page shows

128f0c16f4734c420b0185a492d92e52 *ubuntu-12.04-desktop-amd64.iso

But when I checked my downloaded ISO using the md5sum program I get

57876b3740ee89e75c8fefc93a7ceee6 *ubuntu-12.04-desktop-amd64.iso

I also downloaded the ISO via BitTorrent using http://releases.ubuntu.com/precise/ubuntu-12.04-desktop-amd64.iso.torrent

This time using md5sum for this file shows the correct hash 128f0c16f4734c420b0185a492d92e52, but the ISO is 732MB, not 698MB as shown on the release page.

What could be happening here?

Solution 1

So, firstly, sorry for the confusion here. Fundamentally it came down to a communication glitch between the release team and our sysadmins.

Around release time, we push many of our images out to Amazon's CloudFront service to keep our bandwidth use under control. releases.ubuntu.com is managed directly by the release team, but the images on CloudFront are pushed by our sysadmins, and we have to push there well in advance to make sure everything's in place. The sysadmins pushed the most recent daily build at the time, but after that we had to respin images for some serious bugs, and we forgot to let the sysadmins know about this so that they could update CloudFront. As a result, you were getting out-of-date versions.

We've pushed updated images to CloudFront now, and all should be well, although I'm going to check things over manually just to make sure.

Solution 2

Trust the md5 and not the size. My download matches your size and the md5 has from the site as well.

Comments

[Colin Watson]

No, this was a genuine complete image, just an old one. My answer explains the true situation. Though you're right about MB/MiB.

[psusi]

@ColinWatson, either way, there was still something wrong with the first download, and now it's right ;)

[Admin]

How does one know if a out-of-date image was used for installation? What would be the implications of installing a system from an outdated image?

[Deepak Verma]

I agree that the md5 should be trusted - I don't know if it's possible for two different size files to have the same md5, but I think the odds are pretty low.

[Stefano]

I think that if you download updates, you should be ok.

[cprofitt]

No, two different size files can not have the same MD5... at least that is the theory.

[Deepak Verma]

Well, by "pretty low", I meant slightly less than minuscule. In theory, I believe it is possible; there's only 2^128 combinations, which is a fairly big number, but it is finite... in theory. :)