Fix URL for Debian 8.5.0 ISO

[unsystemizer]

Mirrors automatically update to the current version, so the link was broken.
We could link to an archive site with 8.5.0 or update the URL to 8.6.0. The latter seems better since apt-get update has to be executed anyway.

The SHA256SUM for the v8.6.0 Net Install ISO was updated from http://cdimage.debian.org/debian-cd/8.6.0/amd64/iso-cd/SHA256SUMS

[laanwj]

Concept ACK, but can we somehow avoid having to update this after every minor Debian release? This link breaks too often.

[unsystemizer]

Well, yes.
I considered another idea: completely remove the URL to the ISO file and provide a directory-level link such as http://cdimage.debian.org/mirror/debian-cd/current/amd64/iso-cd/ instead. I can make this change if that's a better medium-term solution.

But then one has to look for the ISO and the checksum CLI example becomes outdated as well, so it's more typing and clicking (although arguably one should obtain the checksum info from the ISO source).
Another thing is I saw a note (in this document) that the process works with 8.5.0 and "should" work with a newer version; but when the current Debian version becomes 9.0 and if that doesn't work with this process, maybe more people would unnecessarily download a v9 ISO.

[laanwj]

I considered another idea: completely remove the URL to the ISO file and provide a directory-level link such as http://cdimage.debian.org/mirror/debian-cd/current/amd64/iso-cd/ instead.

Indeed, then the sha256sum becomes outdated and we still have the same problem.

I'd prefer a direct link to an iso that just keeps pointing at 8.5.0 for the forseeable future, and is not invalidated when 8.6.0 comes out. Not sure such a thing exists though, it came up before, and I don't think anyone could find one.

(although arguably one should obtain the checksum info from the ISO source).

Adding the checksum here is an extra safety step. If you only get that information from the same source as where you get the iso there's the possibility that both have been MITMed.

What could work is, if debian signs the release ISOs with the same GPG key every time, is mention the fingerprint of that key instead, how to get it, and how to verify the ISO.

Edit: though for major releases the user shouldn't be told to grab it automatically. Unless Debian 9 has been extensively tested and cleared for this use, we want Debian 8.

[unsystemizer]

I pointed the URL to the archive site.

[maflcko]

ACK, I like the link to the archive. Please squash your commits according to https://github.com/bitcoin/bitcoin/blob/master/CONTRIBUTING.md#squashing-commits

[unsystemizer]

Okay, will do, soon. I need to setup a Git client (I've been doing everything from the browser so far).

[laanwj]

Why did you close this pull?

Please push to the same branch to keep your changes (for the same topic) together, or at the very least please refer to the previous pull when you create a new one, this confused me as I wondered where the whole discussion went!

[unsystemizer]

Because of the damn github client... I was doing everything through the browser before and after 3 hours of trying I couldn't make Github rebase to work so I closed this PR and submitted a new single-commit PR (of course by then it was getting late so in the new PR I also made a small mistake... terrible). My next PR will be done from Github client.