Fwd: re: New winetricks 20080704: added firefox3, kde verbs (and a whole lot of other stuff)

[Ralf Habacker]

Pau Garcia i Quiles schrieb:
> Hello,
>
> winetricks is a quick and dirty script to download and install various  
> redistributable runtime libraries sometimes needed to run programs in  
> Wine. The last version of winetricks adds support for installing KDE  
> on wine. Dan Kegel is the winetricks developer.
>
> ----- Forwarded message from dank at kegel.com -----
>      Date: Fri, 4 Jul 2008 11:12:56 -0700
>      From: Dan Kegel <dank at kegel.com>
> Reply-To: Dan Kegel <dank at kegel.com>
>   Subject: re: New winetricks 20080704: added firefox3, kde verbs (and  
> a whole lot of other stuff)
>        To: pgquiles at elpauer.org
>
>   
>> I'm one of the kde-windows developers.
>>     
>
> You get around, don't you?  :-)
>
>   
>> To make maintenance of
>> winetricks easier, we've added a kdewin-installer-gui-latest.exe which
>> links to the latest version of the installer. The md5sums file will be
>> updated to contain the md5sum for the -latest.exe file, too.
>>     
>
> Sadly, that doesn't help, because winetricks (for security
> reasons) hardcodes the sha1sum into the winetricks script.
> Imagine: an attacker modifies both the .exe and the md5sum
> file at your site.  The only way I can detect that is to have
> my own copy of checksums.
>   
An alternative would be to use a different download site. It is much 
harder to modify two files on two different sites. For this reason we 
use the kde mirrors and the sourceforge mirrors using a different upload 
method.
> But that's ok, I'm used to updating checksums.
>
> First bug: kstars can't download its extra data :-(
> A +winsock trace isn't too enlightening, nor is a look
> through the source that the kdewin installer downloads.
> I can't even find where the networking is done.
> Got any tips for me?
>   
Are you downloading the extra data through kstars or through the 
kdewin-installer using a specific binary package. As far as I know there 
are no additional kstars binary packages installable by the installler 
so I assume you downloaded it through kstars using the khotnewstuff api. 
In release 4.00.83 I see not additional stuff which is downloadable on 
windows xp, so this support seems no to be implemented or buggy yet.
> BTW the KDEwin installer fails when downloading the helper apps
> process explorer etc. from sysinternals - maybe they have new files,
> and the checksums don't match?
>   
You got a non error message after downloading files which do not have a 
md5 file, isn't it  - I recognized this issue just these days in recent 
installer and are been working on a feature to skip md5 checking for 
files located outside the kde windows mirrors, which all have md5 
support.. This support will probably be in the next release and is 
implemented by the @nomd5 option in the remote config file.

Ralf