Re: [Repo-criteria-discuss] Fwd: Re: repo-criteria-evaluation

[Connor Shea]

With regards to this specific problem with SourceForge, it may be worth considering the addition of an extra criteria (probably in the A level?) for verification of downloads by way of SHA hashes, or some similar mechanism. The problem with that of course being that the site could just modify the SHA hash as well as the software and the user would be none-the-wiser.

Perhaps not the solution we're looking for, then. I'll have to give it more thought.

Best,

Connor Shea, GitLab Frontend Engineering Intern

-- 
Sent from my Apple Car