maximus":3b7nd84x said:
Right now I only provide the hash for the generic installer, which is automatically generated during the build and included in the downloads. I have thought about also generating hashes for the .deb and .rpm installers, but have not added that yet. Maybe I can try to include that info on the page itself, but that would be something else for me to forget to do :roll: I guess need to try to appease you paranoid people LOL
Hahaha, although I am a quite paranoic person (I am a software developer who takes security quite seriously in day-to-day basis), nowadays having the hashes of the binaries for checking the file integrity is an important thing. It not only allows you to detect if the binary has been altered but you can check if your download is corrupted too (i.e. because you didn't download the whole file or something happen int he process).
Many projects have been compromised or it's websites distributed malware due some kind of attack. This even happened to some Linux distros (i.e. Mint) and lots of important software companies. There are some new popular attacks like Supply chain. I am not saying that having the hashes available is the panacea but it's something nice to add (plus, SSL over HTTP in the entire web)
. Of course I am not gonna kill you, I am a fan of your work LOL, just saying hehe.
Personally, I always check the hash/checksum, the PGP sig or whatever at the webpage of the software I download (if it is available). Especially .isos, BIOS or driver files.