Tell me more ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.
up vote 2 down vote favorite
1

I downloaded the iOS SDK file xcode_3.2.6_and_ios_sdk_4.3__final.dmg from the Apple developer site but I'm not sure about its integrity.

Could anyone provide me the md5 or sha1 checksum for it?

share|improve this question
1  
I believe that opening a .DMG file automatically verifies it. Basically, it contains a checksum in the file (or are you worried about malicious packages, rather then just corruption?). – Fake Name Mar 15 '11 at 5:18
I'm just worrying about the corruption. And I'm also curious about where Apple stores the checksum in the file? Can I extract it from the dmg? – stid.smth Mar 15 '11 at 5:24
@Fake Name: I guess you should repost this as an answer, to get the proper upvotes this deserves. @stid: you can use hdiutil verify /path/to/image.dmg on the command line to compare an image against its internal checksum. – Asmus Mar 15 '11 at 7:15

4 Answers

up vote 3 down vote accepted

I believe that opening a .DMG file automatically verifies it.

Basically, it contains a checksum in the file (or are you worried about malicious packages, rather then just corruption?).

Anyways, when I open a .dmg file, I see the message box with a progress bar say "Verifying" for a while, before it actually mounts.

Asmus added in a comment above:
"you can use hdiutil verify /path/to/image.dmg on the command line to compare an image against its internal checksum."

share|improve this answer
Thanks for your reply. – stid.smth Mar 15 '11 at 12:10
up vote 1 down vote

Having an external checksum would still be a benefit. I don't have the resources to download the 4G file without interruptions (power/bandwidth) and I would really like to get it from "somewhere else" where the download technologies are more liberal but be reasonably assured that the file would not be tampered with by some evildoer.

share|improve this answer
Curse those evildoers! – Slomojo Nov 14 '11 at 4:21
BitTorrent is a proven distribution model but it's "not invented here." – Barry Mar 5 at 14:06
up vote 1 down vote

For what it is worth, here are some of the hash values for the copy of the file that I downloaded:

% md5 xcode_3.2.6_and_ios_sdk_4.3__final.dmg 
MD5 (xcode_3.2.6_and_ios_sdk_4.3__final.dmg) = 7c202dee660271397112e1eef96e5f17
% openssl sha1 xcode_3.2.6_and_ios_sdk_4.3__final.dmg 
SHA1(xcode_3.2.6_and_ios_sdk_4.3__final.dmg)= b58be47d6d273b694904eba8fd7df629188fd1f8
% openssl sha512 xcode_3.2.6_and_ios_sdk_4.3__final.dmg 
SHA512(xcode_3.2.6_and_ios_sdk_4.3__final.dmg)= 86d8f84a6a0d5e863dacd1f926cc4a7997a140a7748ea03ce7ce774353fe2fa09fb58ffd86ba8f20843c2698faa2479bf93f0df3741dc6c8f59a17d8f6c2b95d

The hashes can be useful to make sure you are not dealing with malicious modification, but if you are just worried about corruption during transfer, then the internal checksums should be sufficient.

share|improve this answer
They are different than mine. But my dmg file did pass the validation check and the installation is successful. I believe that apple offers an unique dmg file for each user. – stid.smth Mar 16 '11 at 12:46
when you generate an MD5, there's no guarantee you'll get the same code each time, however each of these different codes will correlate properly with the target when verifying. – Slomojo Nov 14 '11 at 4:20
@slomojo: MD5, like other cryptographic hash functions is completely deterministic with respect to the input. A given sequence of input bytes (the contents of the file) will always produce the same output hash value. If someone computes a different value for their copy of the file, then they can be sure that their file is not identical to mine (or that I was lying about my value). – Chris Johnsen Nov 15 '11 at 5:35
@ChrisJohnsen - not sure where I picked up that notion, I must have a fudged memory, the last time I was playing with an MD5 generator, I could've sworn I was getting different hash values each time. Chances are it was a bad implementation, it was a web based MD5 generator, but even so seems unlikely, or I simply misremembered (more likely!) Thank you anyway, always good when duff information gets removed from my brain, even if I do look a bit stupid in the process :) – Slomojo Nov 15 '11 at 23:06
@slomojo: The generator you remember using may have been a salted MD5. Salting is often used as one part of password handling systems because it helps reduce the effectiveness of precomputed lookup tables. A salted hash will produce different outputs for the same input (password), but only because a salt value is included as a part of the input to the hash function. A random salt value is selected when setting a password and is stored with the hashed output; this stored salt is used (in place of a random value) when checking passwords. – Chris Johnsen Nov 18 '11 at 19:19
show 3 more comments
up vote 0 down vote

I wrote some unattended scripts that automate the download and installation Xcode and/or Xcode CLT.

It is most likely that Apple watermarks DMGs with your Apple ID.

Supporting Evidence: Try googling for the md5, sha1, etc. of the dmgs. 0 results likely.

Try this:

  1. Download a file using different accounts.
  2. Use a binary diff tool to compare them.

Betting against bitsquatting, MITM long-tail issues and other things end-users cluelessly ignore/dont understand are unnecessary, avoidable gambles.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.