How do you check the integrity of downloaded open source files?

Question

I would like to start checking that the open source projects that I am using in my apps are what the developers released. I noticed that many projects have a SHA1 and MD5 digests presumably these can be easily tampered with for example if a hacker replaces the orginial zip file on a mirror they can also replace the .md5 and .sha1.

How can I check the integrity of third party open source libraries that I depend on?

Answer 1

typically an open source project, although open to all to download and modify themselves, the ability to actually change the uploaded files is restricted to certain individuals governed by the project owner.

A good example is https://github.com/thecodemine/formwizard, where you can see a read-only link, but cannot modify directly unless authorised.

However you can fork the project to your own account and modify as you wish, for example https://github.com/AlexKey/formwizard

I'm also guessig on large open source projects like linux distributions for example, even code / files uploaded by authorised individuals will also go through stringent reviews before official release.

A hacker of course on comprosising a system could change files at will, but this isn't a weakness of an opensource model but instead could be a problem for any project.

Also things like Code signing help detect unauthorised modification.

http://en.wikipedia.org/wiki/Code_signing

Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted since it was signed by use of a cryptographic hash.

Answer 2

I think , there is No trusted way for this, since the hacker may change the source files and its (md5 or sh1) files. He simply may replace the whole project with another one. so , download the source from trusted sites such as sourceforg and code.google.com and codeproject and mirrors recommended by these sites.

Answer 3

You have not Googled your question. If you do so you'll get a lot of content about it. The link below will teach you how to check the integrity of a downloaded file.

https://help.ubuntu.com/community/HowToMD5SUM

You may also check the following link, which shows that it is very difficult to modify or replace the .md5 and .sh1 files.

Here's the link.