Patch My PC Ideas & Feedback
A community where customers and the community can provide feedback to make a better product for everyone! For more details on how we prioritize requests, please see:
A community where customers and the community can provide feedback to make a better product for everyone! For more details on how we prioritize requests, please see:
It freaks out our security people.
WinSCP specifically has downloads available from winscp.net but cytranet.dl.sourceforge.net is used instead by the publisher.
The security team should be reassured that the checksums are published publicly by WinSCP.net and can then be used to validate the corresponding download from Sourceforge.net. As this is independent of sourceforge it is a good mechanism to confirm the download was not interfered with by them.
Fairly sure this is already occurring as a part of the PMPC process and is included in their catalogue information for the publisher to confirm on download.
We always attempt to provide downloads directly from the vendor. However, the download from the official WinSCP website winscp.net only offers an expiring download URL like this: https://cdn.winscp.net/files/WinSCP-6.5.5-Setup.exe?secure=wHuftHSGvuiR4pwzejnAcA==,1773695787.
Since WinSCP also maintains their source on SourceForge, instead of using the expiring URL, we provide a SourceForge URL for this application.