RE: curl verification

On Mon, 25 May 2026, Dick Brooks wrote:

> The approach you describe works fine for developers that incorporate curl, 
> but what about all the "curl users" that don't have the tarball, how do they 
> verify that the curl release installed and running on their system is 
> trusted?

The main curl release shipped by the curl project is a tarball with source 
code. Thus we document how you verify that release. Our release.

If you get curl any other way, which lots of users do of course, then you need 
to do something else - depending on exactly how you get curl onto your 
systems.

For example, if you install it on a Linux distro I figure you trust and assume 
that the distro packagers already verified it. If you run macOS or Windows you 
probably also presume that the giant companies shipping the operating system 
and make bits end up on your hard drive did some checks before they did so.

-- 

  / daniel.haxx.se
-- 
Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-users
Etiquette:   https://curl.se/mail/etiquette.html