Rigol instruments firmware repository project

[mcinque]

Since Rigol doesn't reply to all those ask for firmware updates, I was thinking to build up on my own an online repository where to keep all the Rigol firmware upgrades that are spread all over your PCs, possibly keeping the details on a post on this forum.

This project will work only if all Rigol users that own the firmwares agree to share their files; but one thing that we must consider is that every firmware must come from a trusted source, since a single wrong bit in the code value could kill the instrument. I don't think that the firmware binary is checked prior the update, so an untrusted source could alter intentionally a firmware to make a massacre.

So I'm asking to you:

Do you think we can manage the "trusted source" firmware issue?
Do you consider that this project will be useful to those who didn't receive any reply from Rigol?
Would you enter this project?

[Altemir]

1. I have some last firmwares and private resource for downloading previous versions.
2. Your resource must has directories(only for read) for different devices, that has only one-two moderators. They rewrites to this dirs from only one common dir for other users after checking.
3. Users writes to common dir any  firmwares, that has rar-format with 5% data recovery information, md5 hash summ, changelog, comments with firmware's source.

[echen1024]

Have at least 2 people submit each firmware version, and generate MD5 hashes for each. Compare, and if they don't match, get more people. Also, make sure that they have at least 25 good posts on the forum.

[mcinque]

Have at least 2 people submit each firmware version, and generate MD5 hashes for each. Compare, and if they don't match, get more people. Also, make sure that they have at least 25 good posts on the forum.

I like it.

@Altemir: the matter is not the container file corruption or its reliability,  it is that some fanatic could intentionally alter a .bin file, zip it and put it online as genuine. Only comparing two releases as echen1024 says we could be sure that the file is not altered.

[Altemir]

This is true, but I also talked about the
possibility of recovering the file and check it after downloading by user.

[KedasProbe]

Although I haven't had any trouble getting the firmware updates, some suggestions:

Some indicator that indicates that it was tested/used should be present, maybe a list of users (forum names).
After a while it can get a trusted score of 100%
(multiple sources doesn't mean that the file is OK, even Rigol can make a mistake)

And some info about firmware changes should be stored (if available)

[idpromnut]

SVN repository with limited commit rights ought to take care of the "how", and +1 for the 2 or more firmware submission + hash cross checks to implement the "quality control".