Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to download Mercurial, (not the "Tortoise" version) but can only find the download link which isn't an HTTPS link. Downloading that file gives me an unsigned "Unknown Publisher" EXE.

How can I be reasonably sure I've got an untampered copy of this programmer's tool.

Note, this question is not to be critical of the Mercurial publishers. I'm just wondering how other Mercurial users check they've got a good download before running the installer.

share|improve this question

migrated from Feb 1 '13 at 18:57

This question came from our site for professional programmers interested in conceptual questions about software development.

I guess you could build it from source yourself. – poke Feb 1 '13 at 18:20
Just be sure check every line of source for viruses – psr Feb 1 '13 at 18:27

Generally validity of any given file can be given by an MD5 checksum, so go see if you can find a published acceptable MD5 sum for the file you want, and check the MD5 for your particular file after download. Publishing MD5 sums is fairly common practice for many things especially open source ones like this.

Rather, as @KeithThompson points out SHA1 is better though it is important to know both MD5 and SHA1 can be forged into accuracy, so more complex cryptographic techniques will give a greater level of guarantee but I see no published signature of MD5, SHA1, or more complex techniques whatsoever, so my suggestion is to trust the MD5/SHA1 combination thanks to Keith Thompson's comment of:

e886b2d2469c848efd67af4c2b63d9d5 (md5)

a2f690fa544adac01fc9d8c66685129ac2d02cb1 (sha1)

I would imagine it would be harder to forge a file to match both hash algorithms than just one, so there's a little help. That is if we trust Keith Thompson... ;)

share|improve this answer
An MD5 (or preferably SHA1 or better) only tells you that the downloaded file matches the checksum. It guards against data errors, but not against fraud. A cryptographic signature is more reliable (assuming you can trust the certificate owner); the Mercurial project doesn't appear to provide those. I can tell you that the md5sum of the copy of Mercurial-2.4.2.exe I just downloaded is e886b2d2469c848efd67af4c2b63d9d5, and the sha1sum is a2f690fa544adac01fc9d8c66685129ac2d02cb1; that might guard against some attacks. – Keith Thompson Feb 1 '13 at 18:33

The ones on TortoiseHG's Bitbucket repository (note that there is also plain Mercurial, withour THG) seem to have a valid digital signature, at least the .msi (however you can download everything via HTTPS). It is strange that there is not even a checksum on Mercurial's website.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .