Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is a reliable source for cryptographic hash values for Mozilla applications?

Update 1: the value from, A344903A030EC2CA9630407C9736FE11, matched the output from md5sum (in Cygwin 1.7.1) on the downloaded file.

In particular what is the MD5 hash for the Windows version of Thunderbird 3.0.1? There is one listed at this site, but I think only the ones coming from a Mozilla controlled domain can be trusted.

Background: I have downloaded Thunderbird 3.0.1, but I could not control from which server. I would like to be sure that the file has not been tampered with.

share|improve this question
Mozilla's Windows installers are also signed themselves - you can see the signature information in file properties. – grawity Feb 14 '10 at 18:29
up vote 2 down vote accepted

On the mozilla ftp, you can find MD5 and SHA1 checksum.

If you need, you can also find hashes for other versions of thunderbird or any other mozilla softwares.

share|improve this answer
There seems to only be a PGP signature for the Windows version of Thunderbird 3.0.1,… Isn't a public key needed to check the file? If yes, which public key would it be? (E.g. for the application or for Mozilla?) – Peter Mortensen Feb 14 '10 at 0:17
Only look at this file (MD5 file I linked above):… -> there you can see " a344903a030ec2ca9630407c9736fe11 ./win32/en-US/Thunderbird Setup 3.0.1.exe " – Studer Feb 14 '10 at 0:20
@Studer: Ah, yes. Thanks. – Peter Mortensen Feb 14 '10 at 0:30
It is important to use GPG to verify the integrity of the SHA1SUMS file. It could be easily tampered with in transit because the site doesn't use HTTPS. – Matthew Flaschen Feb 14 '10 at 1:15
@Matthew Flaschen: where would the public key come from? Isn't… also unsecure? – Peter Mortensen Feb 14 '10 at 1:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .