1

I'd like to download Mercurial, (not the "Tortoise" version) but can only find the download link http://mercurial.selenic.com/release/windows/Mercurial-2.4.2.exe which isn't an HTTPS link. Downloading that file gives me an unsigned "Unknown Publisher" EXE.

How can I be reasonably sure I've got an untampered copy of this programmer's tool.

Note, this question is not to be critical of the Mercurial publishers. I'm just wondering how other Mercurial users check they've got a good download before running the installer.

Improve this question
2
  • I guess you could build it from source yourself.
    – poke
    Feb 1, 2013 at 18:20
  • 3
    Just be sure check every line of source for viruses
    – psr
    Feb 1, 2013 at 18:27

2 Answers 2

Reset to default
2

Generally validity of any given file can be given by an MD5 checksum, so go see if you can find a published acceptable MD5 sum for the file you want, and check the MD5 for your particular file after download. Publishing MD5 sums is fairly common practice for many things especially open source ones like this.

Rather, as @KeithThompson points out SHA1 is better though it is important to know both MD5 and SHA1 can be forged into accuracy, so more complex cryptographic techniques will give a greater level of guarantee but I see no published signature of MD5, SHA1, or more complex techniques whatsoever, so my suggestion is to trust the MD5/SHA1 combination thanks to Keith Thompson's comment of:

e886b2d2469c848efd67af4c2b63d9d5 (md5)

a2f690fa544adac01fc9d8c66685129ac2d02cb1 (sha1)

I would imagine it would be harder to forge a file to match both hash algorithms than just one, so there's a little help. That is if we trust Keith Thompson... ;)

Improve this answer
1
  • 3
    An MD5 (or preferably SHA1 or better) only tells you that the downloaded file matches the checksum. It guards against data errors, but not against fraud. A cryptographic signature is more reliable (assuming you can trust the certificate owner); the Mercurial project doesn't appear to provide those. I can tell you that the md5sum of the copy of Mercurial-2.4.2.exe I just downloaded is e886b2d2469c848efd67af4c2b63d9d5, and the sha1sum is a2f690fa544adac01fc9d8c66685129ac2d02cb1; that might guard against some attacks.
    – Keith Thompson
    Feb 1, 2013 at 18:33
1

The ones on TortoiseHG's Bitbucket repository (note that there is also plain Mercurial, withour THG) seem to have a valid digital signature, at least the .msi (however you can download everything via HTTPS). It is strange that there is not even a checksum on Mercurial's website.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .