As a PSA, CRC checks are insufficient to prevent tampering. CRC checks are designed to detect accidental corruption, not deliberate. Cryptographic hashes, provi

As a PSA, CRC checks are insufficient to prevent tampering. CRC checks are designed to detect accidental corruption, not deliberate. Cryptographic hashes, provided over a secure connection (not http), are the basic minimum. Do note that even then, there have been demonstrated exploits of package managers downloading over http, where the parsers were demonstrated to be compromised. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3462 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3462 (nice summary of the above CVE https://www.securityweek.com/code-execution-vulnerability-impacts-linux-package-manager https://www.securityweek.com/code-execution-vulnerability-im...)