Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'd like to download Mercurial, (not the "Tortoise" version) but can only find the download link http://mercurial.selenic.com/release/windows/Mercurial-2.4.2.exe which isn't an HTTPS link. Downloading that file gives me an unsigned "Unknown Publisher" EXE.

How can I be reasonably sure I've got an untampered copy of this programmer's tool.

Note, this question is not to be critical of the Mercurial publishers. I'm just wondering how other Mercurial users check they've got a good download before running the installer.

share|improve this question

migrated from programmers.stackexchange.com Feb 1 '13 at 18:57

This question came from our site for professional programmers interested in conceptual questions about software development.

    
I guess you could build it from source yourself. –  poke Feb 1 '13 at 18:20
3  
Just be sure check every line of source for viruses –  psr Feb 1 '13 at 18:27
add comment

2 Answers 2

Generally validity of any given file can be given by an MD5 checksum, so go see if you can find a published acceptable MD5 sum for the file you want, and check the MD5 for your particular file after download. Publishing MD5 sums is fairly common practice for many things especially open source ones like this.

Rather, as @KeithThompson points out SHA1 is better though it is important to know both MD5 and SHA1 can be forged into accuracy, so more complex cryptographic techniques will give a greater level of guarantee but I see no published signature of MD5, SHA1, or more complex techniques whatsoever, so my suggestion is to trust the MD5/SHA1 combination thanks to Keith Thompson's comment of:

e886b2d2469c848efd67af4c2b63d9d5 (md5)

a2f690fa544adac01fc9d8c66685129ac2d02cb1 (sha1)

I would imagine it would be harder to forge a file to match both hash algorithms than just one, so there's a little help. That is if we trust Keith Thompson... ;)

share|improve this answer
3  
An MD5 (or preferably SHA1 or better) only tells you that the downloaded file matches the checksum. It guards against data errors, but not against fraud. A cryptographic signature is more reliable (assuming you can trust the certificate owner); the Mercurial project doesn't appear to provide those. I can tell you that the md5sum of the copy of Mercurial-2.4.2.exe I just downloaded is e886b2d2469c848efd67af4c2b63d9d5, and the sha1sum is a2f690fa544adac01fc9d8c66685129ac2d02cb1; that might guard against some attacks. –  Keith Thompson Feb 1 '13 at 18:33
add comment

The ones on TortoiseHG's Bitbucket repository (note that there is also plain Mercurial, withour THG) seem to have a valid digital signature, at least the .msi (however you can download everything via HTTPS). It is strange that there is not even a checksum on Mercurial's website.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.