Eclipse Community Forums: Oomph » Checksum Validation of Installed Packages

Help

Home

Home » Eclipse Projects » Oomph » Checksum Validation of Installed Packages(Validating packages installed by Oomph)

Show: Today's Messages :: Show Polls :: Message Navigator

Checksum Validation of Installed Packages [message #1761183]

Mon, 08 May 2017 15:38

Virginia Pierson

Messages: 2
Registered: May 2017

Junior Member

Does the Oomph installer do any automatic validation of the packages it downloads/installs from mirror sites? Or is this something you have to try and implement yourself?

Report message to a moderator

Re: Checksum Validation of Installed Packages [message #1761304 is a reply to message #1761183]

Tue, 09 May 2017 15:03

Denis Roy

Messages: 449
Registered: October 2004
Location: Ottawa, Ontario, Canada

Senior Member

Packages that are downloaded are signed, and Eclipse does validate those digital signatures.

Denis Roy
Eclipse Webmaster -- webmaster@eclipse.org

Report message to a moderator

Re: Checksum Validation of Installed Packages [message #1761307 is a reply to message #1761304]

Tue, 09 May 2017 15:12

Ed Merks

Messages: 29545
Registered: July 2009

Senior Member

Oomph does no more or less checking than p2 itself does when you install something into an IDE. All signed artifacts are verified, any before any unsigned artifact is installed, you will be asked if that's okay. So if you unless you install unsigned things, you can be sure you're really installing what you're expecting to be installing.

Report message to a moderator

Re: Checksum Validation of Installed Packages [message #1764494 is a reply to message #1761307]

Tue, 30 May 2017 13:39

Virginia Pierson

Messages: 2
Registered: May 2017

Junior Member

Does it also do any checksum validation, like with the SHA or something else? Or is it just the signature, so that if you're downloading unsigned packages you have no way of knowing whether or not it's what you expect?

Report message to a moderator