Take the 2-minute tour ×
TeX - LaTeX Stack Exchange is a question and answer site for users of TeX, LaTeX, ConTeXt, and related typesetting systems. It's 100% free, no registration required.

Does the Miktex Updater ensure that the downloaded packages from a CTAN mirror are not corrupted in comparison to the original version?

When looking up the update log there are messages about a "database digest", but no verify message for a single package is ever appearing.
Additionally, there is a "mpm.ini" file containing hashes for all (?) packages. But if this file is downloaded from the mirror itself (contained in miktex-zzdb1-2.9.tar.lzma), this could have been changed, for this specific mirror, with malicious purpose.

I'm not interested if the files are malicious to begin with (How do CTAN maintainers make sure all the uploaded packages and classess in CTAN are free of malicious code?), but if there are changes to their original versions.

Is there any checking done when updating to ensure the equality of mirror to original files? I could not find any explanation on this topic.

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.