Java™ Application Development on Linux - Dator

218Chapter 9Ant: An Introductionwill find that generally .zip files are intended for Windows machines and.tar.gz and .tar.bz2 for UNIX systems. The .gz format is decompressedwith the gzip utility and .bz2 files with the bzip2 utility. The bzip2 compressionalgorithm produces better compression, while gzip is “more common.” Ifyou have a modern Linux distribution, you almost certainly have both installedalready.Once you have the archive file downloaded, you should download one ofthe files linked next to it. These are cryptographic hashes of the legitimatearchive file so you may be (more) assured that the software is the software youthink it is. The first, PGP, is an actual digital signature. If you are already familiarwith PGP or GnuPG and are comfortable with them, then by all means usethis. It is, as you know, a superior form of validation compared to MD5. Butexplaining how to use digital signatures and GPG keys is beyond our scopehere. As for MD5, however, this is fairly easy.An MD5 hash is a 128-bit value generated in such a way that it is impossiblefor two different files of the same length to have the same hash value (actually,the term used in the literature is “computationally unfeasible,” but forour purposes that is the same thing). If you run the program md5sum with thetarball file as an argument and you get the same number as the one you downloaded,you may be certain that the file you have is an exact match with theone that was used to produce the number you downloaded from the Web page.Remember that this is all that is proved by this. If both the file server and theWeb page have been compromised, then the fact of a match doesn’t meanmuch. A mismatch however proves that one of the two has been compromisedand you probably shouldn’t use the tarball.You should get in the habit of verifying checksums and digital signatureswhere they are supported.If you are still worried about the dual compromise, well, that’s where aPGP digital signature can help. It not only proves the integrity of the data; italso proves the identity of the generator. Learn more about PGP (actually, theFree Software version of it, called GnuPG, at the GnuPG Web site. 4Once you have downloaded both the md5 file and the tarball, validate andextract the tarball (Example 9.1).Note that we did this in a regular user’s home directory. If you just wishto use ant yourself, then this is the way to go. If you wish to make ant available4. http://www.gnupg.org/