4 ms·
If they have access to the packages, they have access to the checksums. The checksums only verify that the file isn't corrupt, what you should receive is what y
by adbachman 15y ago
If they have access to the packages, they have access to the checksums. The checksums only verify that the file isn't corrupt, what you should receive is what you actually received.
- NelsonMinar 15y agoTrue; proper digital signatures would be better. My understanding is the checksums exist to be distributed so that maybe someone would notice "hey, foo.tar.gz on this mirror has the wrong checksum!" The way it works in Homebrew, for instance, is that the sha256 of a file downloaded from the source server is verified against the checksum stored in Homebrew's github repository. Someone would have to compromise both the source server and the github repository to break it. Not ideal, but better than nothing. More importantly it's automatic; Homebrew users don't think about it. git has pretty good signatures for tags. Maybe there's a way to leverage that for secure open source distribution.