Understanding Checksums

[slomojoe]

i use an app called "checksum calculator" which i like but don't really understand very well

i have used it successfully before on sha-256 sums by simply matching the drag and drop .dmg to the posted sum on the website, easy for a non-programmer, non-scripter, non-coder like me

i started paying attention to checksums when i almost, but not quite, got caught in the compromised handbrake distribution of a few years back

i also use a program called "open audible" to back up my audible purchases (it resides on git-hub)

i don't seem to understand nor can i find out how to make md5 checksums work, as you see on the app page they have a link to "Latest release on GitHub with md5 checksums." and when go to the page you have an option to download "md5sum" which i do and then try to match it to the .dmg file by dragging both into "checksum calculator" but i always get very different numbers

as i say, i have used checksum calculator successfully before but can't seem to make it work with md5sums even though the programs has an option to check md5sums

i am not a programmer but hope that maybe somebody could give me a heads up on how this is supposed to work

 

[Nermal]

You can calculate MD5 sums from the Terminal with "openssl md5 filename". It might be worth seeing whether it gives the same result as Checksum Calculator.

 

[Toutou]

when go to the page you have an option to download "md5sum" which i do and then try to match it to the .dmg file by dragging both into "checksum calculator" but i always get very different numbers

You're supposed to get two very different numbers for two different files, that's kinda the purpose of checksums. A checksum of a file is a fingerprint computed by various mathematical methods (usually lots of exponentiation and XORs) applied on all content of the file, every single bit. If two files differ by as little as a single bit, their checksums will not match.

The md5sum file you get to download from GitHub is NOT the same file as your .dmg, so their checksums are different.
The md5sums.dms is actually a plain text file that contains a list of checksums for different files. If you open it in a text editor, you'll see this:

79381d920df75071d22a5c9d4f70216b *OpenAudible_linux_1_4_5.deb
8e8282e7472fdf44484e9c9e78e78b73 *OpenAudible_linux_1_4_5.rpm
f95f63f749075e888b322874aa307c89 *OpenAudible_macos_1_4_5.dmg
a3f62b502a9f579058df3978692138b0 *OpenAudible_unix_1_4_5.sh
b0d7d094e5cfe088c0a05f1eb1537ef1 *OpenAudible_windows-x64_1_4_5.exe

Now go check if the checksum above matches your dmg.
You can also calculate the md5 checksum with

openssl md5 FILE

or

md5 < FILE

in Terminal.

 

[slomojoe]

You can calculate MD5 sums from the Terminal with "openssl md5 filename". It might be worth seeing whether it gives the same result as Checksum Calculator.

i tried and it did thanks!
[doublepost=1554504931][/doublepost]

You're supposed to get two very different numbers for two different files, that's kinda the purpose of checksums. A checksum of a file is a fingerprint computed by various mathematical methods (usually lots of exponentiation and XORs) applied on all content of the file, every single bit. If two files differ by as little as a single bit, their checksums will not match.

The md5sum file you get to download from GitHub is NOT the same file as your .dmg, so their checksums are different.
The md5sums.dms is actually a plain text file that contains a list of checksums for different files. If you open it in a text editor, you'll see this:

79381d920df75071d22a5c9d4f70216b *OpenAudible_linux_1_4_5.deb
8e8282e7472fdf44484e9c9e78e78b73 *OpenAudible_linux_1_4_5.rpm
f95f63f749075e888b322874aa307c89 *OpenAudible_macos_1_4_5.dmg
a3f62b502a9f579058df3978692138b0 *OpenAudible_unix_1_4_5.sh
b0d7d094e5cfe088c0a05f1eb1537ef1 *OpenAudible_windows-x64_1_4_5.exe

Now go check if the checksum above matches your dmg.
You can also calculate the md5 checksum with

openssl md5 FILE

or

md5 < FILE

in Terminal.

thanks a lot ! really helpful ... exactly what i was hoping to find out

ps. what slowed me down was that i tried opening the file with "unarchiver" thinking it was a wrapper of some kind (if you google ".dms" fie you are told it is an amiga file extension !!) and unarchiver wouldn't open it, i tried with bbedit and it wouldn't either but text edit did open it just fine ....