如何检查下载的开源文件的完整性？
我想开始检查我在应用程序中使用的开源项目是否是开发人员发布的。我注意到许多项目都有 SHA1 和 MD5 摘要，大概这些很容易被篡改，例如，如果黑客替换镜像上的原始 zip 文件，他们也可以替换 .md5 和 .sha1。
如何检查我所依赖的第三方开源库的完整性？
I would like to start checking that the open source projects that I am using in my apps are what the developers released. I noticed that many projects have a SHA1 and MD5 digests presumably these can be easily tampered with for example if a hacker replaces the orginial zip file on a mirror they can also replace the .md5 and .sha1.
How can I check the integrity of third party open source libraries that I depend on?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我认为，没有可信的方法，因为黑客可能会更改源文件及其（md5 或 sh1）文件。他可能只是用另一个项目替换整个项目。
因此，请从可信站点（例如 sourceforg 和 code.google.com）以及这些站点推荐的 codeproject 和镜像下载源代码。
I think , there is No trusted way for this, since the hacker may change the source files and its (md5 or sh1) files. He simply may replace the whole project with another one.
so , download the source from trusted sites such as sourceforg and code.google.com and codeproject and mirrors recommended by these sites.
通常是一个开源项目，尽管开放给所有人下载和自行修改，但实际更改上传文件的能力仅限于项目所有者管理的某些个人。
一个很好的例子是 https://github.com/thecodemine/formwizard，您可以在其中看到一个 read-只能链接，未经授权不能直接修改。
但是，您可以将项目分叉到您自己的帐户并根据需要进行修改，例如 https://github.com/AlexKey /formwizard
我也猜测像linux发行版这样的大型开源项目，即使是由授权个人上传的代码/文件在正式发布之前也会经过严格的审查。
当然，入侵系统的黑客可以随意更改文件，但这并不是开源模型的弱点，而是可能成为任何项目的问题。
代码签名之类的东西也有助于检测未经授权的修改。
http://en.wikipedia.org/wiki/Code_signing
typically an open source project, although open to all to download and modify themselves, the ability to actually change the uploaded files is restricted to certain individuals governed by the project owner.
A good example is https://github.com/thecodemine/formwizard, where you can see a read-only link, but cannot modify directly unless authorised.
However you can fork the project to your own account and modify as you wish, for example https://github.com/AlexKey/formwizard
I'm also guessig on large open source projects like linux distributions for example, even code / files uploaded by authorised individuals will also go through stringent reviews before official release.
A hacker of course on comprosising a system could change files at will, but this isn't a weakness of an opensource model but instead could be a problem for any project.
Also things like Code signing help detect unauthorised modification.
http://en.wikipedia.org/wiki/Code_signing
你还没有用谷歌搜索你的问题。如果您这样做，您将获得很多相关内容。下面的链接将教您如何检查下载文件的完整性。
https://help.ubuntu.com/community/HowToMD5SUM
您还可以查看以下链接，由此可见，修改或替换
.md5和.sh1文件是非常困难的。<一href="http://books.google.co.in/books?id=AHzAcvHWbx4C&pg=PA305&lpg=PA305&dq=can+a+hack er+modify+the+md5+hashes&source=bl&ots=c2kDjYXSXE&sig=-ZIEzo8Q66Go0fLkn1HTyvho0sw& hl=en&ei=GiLPTu_UA5HxrQeCot2xDA&sa=X&oi=book_result&ct=结果&resnum=9&sqi =2&ved=0CG0Q6AEwCA#v=onepage&q=can%20a%20hacker%20modify%20the%20md5%20hashes&f=false" rel="nofollow">这是链接。
You have not Googled your question. If you do so you'll get a lot of content about it. The link below will teach you how to check the integrity of a downloaded file.
https://help.ubuntu.com/community/HowToMD5SUM
You may also check the following link, which shows that it is very difficult to modify or replace the
.md5and.sh1files.Here's the link.