Does the Miktex Updater ensure that the downloaded packages from a CTAN mirror are not corrupted in comparison to the original version?

When looking up the update log there are messages about a "database digest", but no verify message for a single package is ever appearing.
Additionally, there is a "mpm.ini" file containing hashes for all (?) packages. But if this file is downloaded from the mirror itself (contained in miktex-zzdb1-2.9.tar.lzma), this could have been changed, for this specific mirror, with malicious purpose.

I'm not interested if the files are malicious to begin with (How do CTAN maintainers make sure all the uploaded packages and classess in CTAN are free of malicious code?), but if there are changes to their original versions.

Is there any checking done when updating to ensure the equality of mirror to original files? I could not find any explanation on this topic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.