Re: verifying authenticity of Omnigroup software

Joe Malcolm <[email protected]> Wed, 5 Feb 2014 18:17:30 +0000

Newsgroups	gmane.comp.graphics.omnigraffle.user
Message-ID	<[email protected]>

Wim Lewis writes:
>On 4 Feb 2014, at 2:17 PM, Joe Malcolm wrote:
>> Does Omnigroup publish md5/sha hashes or signatures for its software?
>> It appears that the download link is http, not https.
>
>Our appcast feeds (used by the software update functionality) contain cryptographic hashes of the file downloads, but I don't think the hashes are visible on our website.

OK. Your built-in mechanism helps when installing minor upgrades, but
as far as I can see, not when installing a new major version.

Joe