3 ms·

If a hosting server is compromised the hash and download can be changed with something nefarious. crypto signing/verification will catch that case. hash checkin

by mfer 7y ago

If a hosting server is compromised the hash and download can be changed with something nefarious. crypto signing/verification will catch that case. hash checking will not. This is a legitimate case as it's happened to other projects in the past.

groobongithub 7y ago
The download comes from dl.google.com while the checksum is published on golang.org. FWIW the macOS pkg you download is signed.