4 ms·
> We do not provide checksums for the tarballs simply because providing checksums next to the downloads adds almost no extra verification. If someone can tamper
by Karellen 3y ago
> We do not provide checksums for the tarballs simply because providing checksums next to the downloads adds almost no extra verification. If someone can tamper with the tarballs, they can probably update the webpage which a fake checksum as well.
In the past, I have occasionally downloaded a tarball from one mirror, and verified against a checksum from a different mirror (or from the official website). Back when release announcements were primarily made on mailing lists, using a mailing list archive to get a copy of the "real" checksum was also a possibility.
I definitely remember being advised to get the checksum from a different source than the tarball, a number of different times.
> Our policy says that if a contrition is good:
* contribution
- inopinatus 3y agoThere are many ways to induce download of the wrong file, not just tampering with the origin website. An old-school MITM remains a real hazard and in some organisations/nations it is directly enabled by the local infrastructure. Ultimately this is why we also sign the checksum. (Now you have to protect your signature verification supply chain. It never ends)
- chaz6 3y agoOne alternative is to sign the checksums using a PGP key, though that does raise the issue of how to know if the key has been compromised or not.
- lrvick 3y agoMultiple signatures by multiple people who got the bit-for-bit identical result.