How does verifying the checksum confirm the integrity of a downloaded file, when it’s posted on the same website the file came from?
In: 27
If you are concerned about accidental corruption, it is HIGHLY unlikely that a large downloaded file will have the same corruption that matches a corrupted webpage / checksum file.
Alternatively, a checksum on a trusted site allows you to validate the authenticity of a file procured from an untrusted site (IE, pulling down Centos7 ISO via bittorrent and ensuring it is unmodified).
If you are protecting againt something like a site hack where someone could modify the file AND the checksum at the same time, you get into the zone of digital signatures / code signing where the workflow would require that the private keys in order to create the signature are not readily available — someone hacking the site could replace the file and its signature, but the signature would not be trusted since it is not signed by the correct key.
Latest Answers