[cmake-developers] malware?

[Sean McBride]

On Fri, 24 Jul 2015 11:40:09 -0400, Chuck Atkins said:

>I just checked the cmake.org download and was able to verify the following:
>
>cmake-3.2.3-Darwin-x86_64.dmg - 27949121 Bytes - MD5
>97c26048e9b3e242951bb5b1ff88da9e
>cmake-3.3.0-Darwin-x86_64.dmg - 22628082 Bytes - MD5
>232ae38586f3e6b665f9b7ac281167a0
>
>I checked from both inside and outside Kitware's network as to verify
>internal and external were the same.  Are these the same for the files you
>downloaded from cmake.org?  Can you try to download from a different
>machine to verify it's not a local problem?

If you're trying to detect imposter binaries, don't use md5.  In fact, don't use md5 ever for anything:
<https://en.wikipedia.org/wiki/MD5#Security>

I get the following for my cmake download:

$ shasum -a 256 /Users/sean/Downloads/cmake-3.3.0-Darwin-x86_64.dmg 
0282d6f139f5292c2bb9b3d600df6b7db242d8f53c4ab8d1e6ddff76402e0eab  /Users/sean/Downloads/cmake-3.3.0-Darwin-x86_64.dmg

Cheers,

-- 
____________________________________________________________
Sean McBride, B. Eng                 sean at rogue-research.com
Rogue Research                        www.rogue-research.com 
Mac Software Developer              Montréal, Québec, Canada