File transfer infrastructure and verification issues

[code_man]

I have been playing s44 with the guys recently and we had problems with both a game file and a map one time, one of the servers on springfiles hosts incorrect files which were grabbed by springlobby.
Files in question are tabula v4 and spring 1944 equilibrio 2.071 if you want to debug this, we checked the sha1 sum and they had not matched in the later case, we managed to get it to work after a bit by using different mirrors.
This raises the question however why springlobby had not intercepted this, i think this is a quite serious issue, especially for newbies who dont know how to replace files, or things that are downloaded from rapid even, it took us like 10 minutes to fix this, most players wont have that patience.
Even tough spring lobby has shown that we were all synced, desyncs have happened at game start.
I dont know if error checking should be implemented in lobbies only or even in unitsync, tough even then the main problem lies in how springfiles/rapid should handle error checks, encoding them in the file directly would be a hastle for developers but on the other hand if you dont files might well be corrupted during uploading perhaps.
At the very least some way of providing checksum should be available, when uploading so people who upload or download can check.
Im hardly paranoid about security issues, but this could be exploited probably.

If we had functioning error check then p2p architecture might also be feasable, as i understand currently springfiles mirrors are the sole providers for maps and non-rapid games, this would seriously reduce load on these and probably help download speed up for people too.

Another thing i want to ask here that is related is that as i understand rapid is a distribution system to download and assemble files from version control system repositories that only downloads files to make an archive that is not available on the system, is that correct?
Now i what i wondered is if i can use rapid without git.
My intention is to distribute maps in a developmental stage, i do not want to distribute them on springfiles as long as i dont consider them done, but i do need people to test them.
What i would want of it is that i can distribute maps but not actually publish them, as in advertise them and it would also give me the advantage bandwith/space would not be wasted on features and such sort.

I hope i didnt make any huge ignorrant mistakes here, would much appreciate of devs could look into this.

[abma]

checkout http://api.springfiles.com/

pr-downloader (what is used by springlobby) verifies checksums! if it is wrong, it uses the next mirror.

only thing you currently can complain is, that the connection pr-downloader to api.springfiles.com is unencrypted. but its a custom protocol / api, a MITM would require to be coded specific for this api.

[abma]

My intention is to distribute maps in a developmental stage, i do not want to distribute them on springfiles as long as i dont consider them done, but i do need people to test them.

you want to distribute maps, but you don't want to distribute it?

imo you are requesting https://github.com/springfiles/upq/issues/49


also, which lobby version was used? infolog.txt would be useful, too.

[Silentwings]

My intention is to distribute ... in a developmental stage ... i do need people to test them.

Hosting (or uploading to random filehost) your own sdz, with internal name suffixed by "-test" or smth similar, is the classic way to do this. A more modern way is it to set up a git/svn repo somewhere and just have people checkout your latest version into a folder named .sdd.

[code_man]

This is highly inoptimal for me, i would want the same way we can have unstable versions of games being available trough rapid applicable for maps too.

Im sure this will be important in the future.

Also is it possible to specify 3rd party file hosts as download servers for files in a autohost/lobby rather than springfiles?