點樣去 trust 7zip ?

我係佢官網 (http://www.7-zip.org) 揾唔到任何md5 或 sha-1做download完既integrity. 各Ching有冇建議?我自己試build,個executable upload 去virustotal.com 有兩個alert,唔知係咪false positive? 我仲有冇其他方法做trust呢?

你用開嘅 disto, 有 pkg manager 應該唔洗自己搞
呢個係 gentoo 7z Manifest 入面嘅 info
睇吓有冇用
  1. DIST p7zip_15.09_src_all.tar.bz2 4048481 SHA256 8783acf747e210e00150f7311cc06c4cd8ecf7b0c27b4adf2194284cc49b4d6f SHA512 4f020b13632ef7a85aa8a98586b59bef2dde3c1cbebdbd17e01f1d09b2e13a56ecfe82546d7efc677c45df67456a71cfdb67826b53ebea4c0fb4878f20c2f6dd WHIRLPOOL 71d1cdb9b3b1208197b2c056670d057b00e9a5f80cf08b5914b5d25f2f6756d4cb53e5a000ec76b7b879f82302fca6d012a2cd397e8aa95ae4fc21fd620eb1ab
  2. DIST p7zip_15.14.1_src_all.tar.bz2 4147911 SHA256 699db4da3621904113e040703220abb1148dfef477b55305e2f14a4f1f8f25d4 SHA512 30d0ef47bd6938cdd5d9d80ec6e7aed972655686a43adb0ae34bb9856ec7cd5a68a05c580352021055cefd6eeceb134ff6402f93686ce46e57f9757798e76abd WHIRLPOOL ace6204d3ab08002b6d5657ae280e22b7e26cdfe0af8099024ad8562a68aa5097a8f09d9d49904a06b9a6942d30fbf3d7a3872661433dd4f76c33dea03ccfb6a
  3. DIST p7zip_15.14_src_all.tar.bz2 4147609 SHA256 b9b77450e98859454d39002f55ddc95a0705041ebc0a9bb49733ce2d9a7292d8 SHA512 3053647cbcb3b8efd7f41b6bc122e984b999d31720f9b22387c52ccfe8a71d73899b1fb3a269854fd43bc1ca656c7d53457aca1cb5e2c90a2d0fb8f084bdebc5 WHIRLPOOL 52a397e4ea15cdd4c68156a0c32d449be78469d5704e0d4bb644a813b583422b3d7b0741284974ca22d9ea99a303dfadeccc23d74a77cac0c9b51153bd61e24b
  4. DIST p7zip_9.20.1_src_all.tar.bz2 3835235 SHA256 49557e7ffca08100f9fc687f4dfc5aea703ca207640c76d9dee7b66f03cb4782 SHA512 7bb8a276aaefc4a83364e45633c48527de44c6b1205344f3356db570582f30f81d82a94938c99a7ad193587b584cc1c03219c28249de40018bdaee6c3b2a022a WHIRLPOOL cb20f37d3f796931a9b330728aa7148afe98bbf8a49bb91bfd80e4667c16416206b23bf34298e9ec37825e8b43f92a5710f0cea1f974296d5c17aa2c7b0931f3
  5. DIST p7zip_9.38.1_src_all.tar.bz2 3917925 SHA256 fd5019109c9a1bf34ad3257d37a6853eae8151ff50345f0a3ffba7d8c5fdb995 SHA512 f524ffae54e0d9563a509cc4b243e830d882a925e682eb2e15e2d19cb72c947fddecd72c8507d6c1538b997b240b0827046fc2fb4f5e3f7d49840257c92b9c04 WHIRLPOOL 6bad1cde056ab1e8db4079c0e649665fbc7e6b9a565261188bd0acaec6c583d8bd9425cb26d39315408d0180ba0be0069a77b704633cf05ec855220cb31f1c24
複製代碼

TOP

另外兩個假設
1.官網有md5/sha checksum但原來比人hack咗改埋
2. 自己compile source但原來但source比人改咗,點compile都係有問題。

答案咁唯有自己寫比自己用不再信任何其他人嘅軟件

TOP

回覆 3# a2940u2w
官網冇上HTTPS,所以其實可以係ISP / Free WiFi搞你
(我絕對唔係講緊Ubuntu官網)

唔知GPG key可唔可以對應呢種情況?

TOP

提示: 作者被禁止或刪除 內容自動屏蔽

TOP

提示: 作者被禁止或刪除 內容自動屏蔽

TOP

提示: 作者被禁止或刪除 內容自動屏蔽

TOP

提示: 作者被禁止或刪除 內容自動屏蔽

TOP

提示: 作者被禁止或刪除 內容自動屏蔽

TOP

提示: 作者被禁止或刪除 內容自動屏蔽

TOP