Verifying VMware Downloads

Now that vSphere 5.1 and assorted products have been released into the wild, how do you check the integrity of your downloaded file? As you might be aware of, VMware publishes both MD5 and SHA1 hashes for their files, making it possible to check if the file you just downloaded is identical to the file offered from VMware.

Checking the MD5 or SHA1 hash for a single file is easy, at least in OS X where you don´t need any third party tools to check.

Open up Terminal and navigate to your download directory and run either the md5 command, or the shasum command to verify the file signature. You can then compare the signature to the checksums provided by VMware on the download page.

  

For a single file, this is not a problem, but what if you have downloaded a bunch of files into a directory and want to calculate the checksums for all of them in one go?

Thankfully this is pretty simple as well, just add a little Terminal (It´s really bash, I know) magic and you´re all set:

MD5:
find . -type f -exec md5 '{}' \;

SHA1:
find . -type f -exec shasum '{}' \;

These small bash one-liners will go through all the files in the current directory, and calculate checksums for each of them.

There are tools available for Windows as well that perform the same operations, but I haven´t looked into those for this post.

A collection of MD5/SHA1 checksums for the vSphere 5.1 Release:

FilenameMD5SUMSHA1SUM
VMware-VMvisor-Installer-5.1.0-799733.x86_64.isofda2bed9a305b868dcbdc15c6ab6c1538c54a4390d98a94a7d759960dc605b41b49d5946
VMware-ESXi-5.1.0-799733-depot.zipe1e0af718719ab680e04a75a62e983ff943a5035ade07d9618a3d41908a29b20ac5fa88c
VMware-viclient-all-5.1.0-786111.exe11222d8f030a2a0da6882a7c34ebc7da0bf0734bbc978f4dff2cd70b1e1708971aada2b4
VMware-tools-linux-9.0.0-782409.iso747125eac04aff34a4f6dd197f9bf64233e636fb1431d060286adb074bb0d221d012ec24
VMware-vShield-Manager-upgrade-bundle-5.1.0-807847.tar.gz9d2ed1a46cad3c72d426380fd48267a7b794ac29a509d3fdbfe474b766846eea42d7e108
VMware-vShield-Manager-5.1.0-807847.ova2b482bd152d8f150e1ef6c0c52e17d97fe793dff3bbdeb922608c1e9eb03302c0486036d
vCO_VA-5.1.0.0-817595_OVF10.ovf5f9cdd24c57d4f976a57bc0c2ebac881b607459a574be4095e1a3031904630f57d753b1e
vCO_VA-5.1.0.0-817595-system.vmdke19c5cd728fc1d226b07064a052a05e7e2e7ed95e8fadf51b405aa85dc8845133600411e
vCO_VA-5.1.0.0-817595_OVF10.certc636547afb4de258d9164a74ac622674bf0834164c7a4ab84c961f250d765720ab34e47f
vCO_VA-5.1.0.0-817595_OVF10.mf80518ba8879f043b804642ba8b071a0a2b3a07c5c641034d693225c4953d10e119060272
VMware-vsa-all-5.1.0.0-825285.iso50345151c119d7af424dc996a890a8f4428ea698601355b7be5bb31ec89041a6b1b9db65
VMware-vsa-all-5.1.0.0-825285.zip9cf4fc6f58448e132be66f71aa140974c19ae506a5f0f17adfd0d073cfd6e12a60a504b6
VMware-VSAClusterService-5.1.0.0-825153-linux.zip96bb44516b3d7b5a78244ba2691d2b294194fa4536e836d874ee5e2325a271ae3c95f862
VMware-vsaclusterservice-all-5.1.0-825249.exe98f51df6551be140d8b22acac9d17072ebd6ddddbd315e3822bfdc2d22f306da862a26b2
VMware-vsamanager-all-5.1.0-825249.exe9f5465f2720d8851023ca6d4a7b2c1623ce5d89ab0cd57b8ac209605f283bb0e1ccca676
VMware-vSphere_Replication-5.1.0.0-819475.ova551d39276c79d21bbd6811cbd86b241f37684077cdc339969e8944fbf684e15c260dec7e
vSphere_Data_Protection_-_0.5TB.ovae7d251b8fe9a23ec0b380be95490cf47e42d630ccf7f7d80d0830bd57b8fc706b3be4af
vSphere_Data_Protection_-_1.0TB.ovad4c776e95cf76fe12292b908e3153b6d1ad0e382bf3f86883c6ba415939c09d7461d524d
vSphere_Data_Protection_-_2.0TB.ova15bdea21d3179d966ca27a5b3ac0a695d77630679f66578cf7ae2b2323831461a3b5feb4

 

As far as I can tell, VMware does not offer a single page that lists all of the checksums for their files, something that makes finding the checksums a bit tedious. I´ve found that the best way to find then, after you have downloaded the files, is to check the My VMware Downloads History, page since it shows you all the downloads you have performed on one page, instead of going through multiple pages. Find the “Show Checksums” link to show the checksums, without having to open the download page for each item.

  

Wishlist

I´m sure some scripting Wizkid could easily create a script that runs the checksum generation and then checks a given text file for a match, but I really wish VMware would create a service that enables you to easily check the checksums for a given file, without having to log on to VMware.com at all.

If we could do a simple HTML request to a service that returns the checksum for a given file, that would easily be scriptable and comparisons could be performed automatically.

That way, doing a request like this (yes, this is indeed a fake non-working URL):
curl vmware.com/integrity/md5/vCO_VA-5.1.0.0-817595_OVF10.cert

would return a simple

c636547afb4de258d9164a74ac622674

Good idea? Bad Idea? Let me know!

2 thoughts on “Verifying VMware Downloads

  1. My distro uses md5sum rather than md5. I also found it useful to add the -maxdepth 1 parameter to find to limit it to the current directory.
    find . -maxdepth 1 -type f -exec md5sum ‘{}’ \;

Leave a Reply