TeX - LaTeX Stack Exchange is a question and answer site for users of TeX, LaTeX, ConTeXt, and related typesetting systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Does the Miktex Updater ensure that the downloaded packages from a CTAN mirror are not corrupted in comparison to the original version?

When looking up the update log there are messages about a "database digest", but no verify message for a single package is ever appearing.
Additionally, there is a "mpm.ini" file containing hashes for all (?) packages. But if this file is downloaded from the mirror itself (contained in miktex-zzdb1-2.9.tar.lzma), this could have been changed, for this specific mirror, with malicious purpose.

I'm not interested if the files are malicious to begin with (How do CTAN maintainers make sure all the uploaded packages and classess in CTAN are free of malicious code?), but if there are changes to their original versions.

Is there any checking done when updating to ensure the equality of mirror to original files? I could not find any explanation on this topic.

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.