Checksums of software downloads

Question

Where can I find checksums (MD5, SHA1, etc.) for Sophos software downloads?

I've had a good look on the download pages, tried searching the knowledge base and forums for an answer and tried a general internet search but I have had no luck (and wasted too much time!).

In this particular instance I'm looking for a checksum for Anti-Virus for VMware vShield (ssvm_sfx_1_1_8.exe) and Sophos Enterprise Console (sec_522_sfx.exe) but I would expect to find them for all enterprise software downloads.

Thanks.

This thread was automatically locked due to age.

QC · Accepted Answer

Hello Neil-J, undetected corruption during download (i.e. seemingly successful download) should be rare and will, due to the downloaded file's structure, be noticed when one tries to use it (arguably this takes less time than calculating the checksum). Apart from this the parts are signed. As to nefarious activities , the downloads are not provided by arbitrary and perhaps dubious sources. Not that they are completely immune against substitution. Last but not least, the checksum has to be genuine - as you are likely obtaining it through the same channels as the download a dedicated attacker can easily modify it as well. Christian  :52190

ruckus · Answer

Sophos only provides checksums for some of the downloads - not all. Many of the downloads have a signature for security.

Example:

:52241