up vote 1 down vote favorite
share [g+] share [fb]

What is a reliable source for cryptographic hash values for Mozilla applications?

Update 1: the value from http://releases.mozilla.org/pub/mozilla.org/thunderbird/releases/latest/MD5SUMS, A344903A030EC2CA9630407C9736FE11, matched the output from md5sum (in Cygwin 1.7.1) on the downloaded file.

In particular what is the MD5 hash for the Windows version of Thunderbird 3.0.1? There is one listed at this site, but I think only the ones coming from a Mozilla controlled domain can be trusted.

Background: I have downloaded Thunderbird 3.0.1, but I could not control from which server. I would like to be sure that the file has not been tampered with.

link|improve this question
84% accept rate
Mozilla's Windows installers are also signed themselves - you can see the signature information in file properties. – grawity Feb 14 '10 at 18:29
feedback

1 Answer

up vote 2 down vote accepted

On the mozilla ftp, you can find MD5 and SHA1 checksum.

If you need, you can also find hashes for other versions of thunderbird or any other mozilla softwares.

link|improve this answer
There seems to only be a PGP signature for the Windows version of Thunderbird 3.0.1, releases.mozilla.org/pub/mozilla.org/thunderbird/releases/… Isn't a public key needed to check the file? If yes, which public key would it be? (E.g. for the application or for Mozilla?) – Peter Mortensen Feb 14 '10 at 0:17
Only look at this file (MD5 file I linked above): releases.mozilla.org/pub/mozilla.org/thunderbird/releases/… -> there you can see " a344903a030ec2ca9630407c9736fe11 ./win32/en-US/Thunderbird Setup 3.0.1.exe " – Studer Feb 14 '10 at 0:20
@Studer: Ah, yes. Thanks. – Peter Mortensen Feb 14 '10 at 0:30
1  
It is important to use GPG to verify the integrity of the SHA1SUMS file. It could be easily tampered with in transit because the site doesn't use HTTPS. – Matthew Flaschen Feb 14 '10 at 1:15
1  
@Matthew Flaschen: where would the public key come from? Isn't releases.mozilla.org/pub/mozilla.org/thunderbird/releases/… also unsecure? – Peter Mortensen Feb 14 '10 at 1:34
show 1 more comment
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.