Some software has sha256 or similar? Are they being controlled?

[Martin15135215]

For example, blender

[ivan-hc]

Sorry, there is no sha256 check, I delegate every check to the user, as already said here:

https://github.com/ivan-hc/AM-Application-Manager#spyware-malware-and-dangerous-software

Blender's editions come from the official website.

[Martin15135215]

Unfortunately, I can't check the sha256 because the tar archive after it is downloaded, it is directly unarchived. The sha256 was made for the tar archive. In this example with blender

The sha256 is here, to check if the blender tar archive did not get damaged during the transfer over the internet

To check sha256 there are the gnu coreutils -> https://www.gnu.org/software/coreutils/manual/html_node/sha2-utilities

I think we can expect, that many linux distro got the gnu coreutils installed

---

Against a “hacker” the sha256 is however useless, since when a “hacker” intercepts the Internet connection or creates a fake website, the “hacker” can also generate a new sha256 for his “hacked” build

A signature created with gpg, for example, does help against this kind of attack. APT uses this. Since the signature can only be created with the private key of the maintainer. So for the potential “hacker”, beside creating a “hacked” build and generating new sha256, does also need to get somehow the private key of the maintainer, to sing his “hacked” build and/or his sha256 file.

[ivan-hc]

APT has its own repository of packages, AM doesn't have it. As I have already said, you can download the script and download the archive by yourself (just check the commands listed into it). Official or third-party sources are always listed in these scripts, you can't be wrong.