Hello I'm vera...
I've just registered and downloaded Inkscape from Inkscape web-site because I think its a great program
Unfortunately at the end of download by checking in the properties tabs, no digital signature tab and also nothing about hash codes (MD5 and/or SHA1 CRC32) in Inkscape site, neither in the Inkscape folder or on this forum
I always choose to download and use on my PCs (WinXP Pro and OpenSuse) digitally signed software or with MD5 and/or SHA1 hash codes to verify that the program has not been corrupted or tampered during the download
Now I try Inkscape only on my virtual PC and this is the reason why i am asking your support: can you please public hashes for Inkscape Installer lastest version from Souceforge.net _Inkscape-0.46.win32.exe_?
I hope you answer me as soon as possible
Thanks in advance and sorry for the length of the topic
vera....

I actually thought SourceForge would offer MD5's of their downloads, but it seems they don't.

I've never heard of anyone using MD5's as validation for ensuring someone didn't intercept your request and injected malicious code into the package--I should thinking it's extremely unlikely, and I've never ever heard of such a thing happening.

I've only ever used MD5s to verify Linux ISO's because it's a pain the the arse when your installation fails on the 4th disc. If the download of an EXE was not perfect the file simply won't run--Windows will report corruption--this is true for most binary files.

A secure connection isn't something designed to protect the download of a binary file (although it does) but is to protect any personal information that is passed between your PC and a website.

I would suggest you are being overly paranoid by not trusting the file you have downloaded. It would take some amazing effort for someone to intercept it. I'm not even sure that anyone writes viruses that embed themselves in binary files anymore--it wouldn't be effective enough--let alone embed a code mid-transfer.

Note that you can get a sig file from http://sourceforge.net/project/showfile ... _id=583320 but I don't know how you use it to validate a file.

microUgly wrote:I actually thought SourceForge would offer MD5's of their downloads, but it seems they don't.

I've never heard of anyone using MD5's as validation for ensuring someone didn't intercept your request and injected malicious code into the package--I should thinking it's extremely unlikely, and I've never ever heard of such a thing happening.

I've only ever used MD5s to verify Linux ISO's because it's a pain the the arse when your installation fails on the 4th disc. If the download of an EXE was not perfect the file simply won't run--Windows will report corruption--this is true for most binary files.

A secure connection isn't something designed to protect the download of a binary file (although it does) but is to protect any personal information that is passed between your PC and a website.

I would suggest you are being overly paranoid by not trusting the file you have downloaded. It would take some amazing effort for someone to intercept it. I'm not even sure that anyone writes viruses that embed themselves in binary files anymore--it wouldn't be effective enough--let alone embed a code mid-transfer.

Note that you can get a sig file from http://sourceforge.net/project/showfile ... _id=583320 but I don't know how you use it to validate a file.

Hi...thanks for the reply...but:
. SourceForge don't offer hash codes for Inkscape.
.I know that only ways for verify downloads are: a valid digitall signature (now also free for example on Comodo group or CACert) Without digital sign a lots of developers public their program hash codes. You use hash for your ISO file...right? I think this is important first of all for developers and also for program users: if you manipulate a file, its Hcodes changes.
Also on Windows Vista/Server 2008 and OpenSuse/Linux hash codes use for security reasons!
. In any case, can someone public Hash codes for original Inkscape installer on your archive? It's difficult todo?
Thanks...vera

zon wrote:. In any case, can someone public Hash codes for original Inkscape installer on your archive? It's difficult todo?

You would have to ask on the developers mailing list. Only the person who puts the file on SourceForge can provide a hash you can trust.

Hi,
I work for a company called Verizon, and wanted to use Inkscape for SVG creation. But inkscape is not an approved software because when it is downloaded, we do not have a digital signature in the software and the company folks are worried as it is not ceritifed by anybody not to contain any malicious code.

Please can you let me know if we can get a downloaded copy of inkscape which has a digital signature attached along with the download.

Regards,
Vikram CP

I highly suggest signing the paper with a black sharpie, in large letters. The black sharpie looks just like pen when it is shrunk down, and the quality is often much better this way!
I also deal with a kind of crappy scanner at work, so sometimes I’ll open the large sharpie signature in Photoshop, zoom in, and use the fill in tool to make the signature nice and complete before shrinking it down to size