FOSS Resources

Software Security

Practical FOSShub guides to safer downloads, checksums, digital signatures, cryptographic hashes, and software trust decisions.

How to Check If a Download Is Safe

Check whether a software download is safe by verifying its source, file, signature, checksum, reputation, and expected behavior before running it.

Learn what a file checksum is and compare SHA-256 values on Windows, macOS, and Linux to detect an incomplete or altered download.

Understand code signing, certificates, timestamps, and what a valid software digital signature can and cannot tell you about a download.

Learn how cryptographic hash functions create message digests, why small changes matter, and how hashes support checksums, signatures, and passwords.