search

rzander / ruckzuck

software package manager for windows
https://ruckzuck.tools
Microsoft Public License
223 stars 20 forks source link

SHA256 Hash instead of MD5 Hash #230

Closed x0tester0x closed 1 year ago

x0tester0x commented 1 year ago

A SHA256 Hash is more reliable than a MD5 Hash, so why do you calculate MD5 Hashes and not SHA256 Hashes?

rzander commented 1 year ago

RuckZuck does support SHA256 as HashType. The goal of the File check is to check the integrity of the file (download was complete and no bytes where lost during download)... and MD5 does still guarantee this. It's theoretically possible that someone generates an excutable with the same MD5 hash and replace the original source with a fake one... then RuckZuck will not recognize that... But be honest, if you create a new package in Ruckzuck and you download a File from a trusted source... even if you create a SHA256 Hash, how can you guarantee that the file is not modified?