{"action":"opened","issue":{"url":"https://api.github.com/repos/atom/atom.io/issues/57","repository_url":"https://api.github.com/repos/atom/atom.io","labels_url":"https://api.github.com/repos/atom/atom.io/issues/57/labels{/name}","comments_url":"https://api.github.com/repos/atom/atom.io/issues/57/comments","events_url":"https://api.github.com/repos/atom/atom.io/issues/57/events","html_url":"https://github.com/atom/atom.io/issues/57","id":135523590,"number":57,"title":"[Website-Security] Please provide a way to check downloaded contents e.g. MD5 hashes","user":{"login":"ottlinger","id":1323134,"avatar_url":"https://avatars.githubusercontent.com/u/1323134?v=3","gravatar_id":"","url":"https://api.github.com/users/ottlinger","html_url":"https://github.com/ottlinger","followers_url":"https://api.github.com/users/ottlinger/followers","following_url":"https://api.github.com/users/ottlinger/following{/other_user}","gists_url":"https://api.github.com/users/ottlinger/gists{/gist_id}","starred_url":"https://api.github.com/users/ottlinger/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ottlinger/subscriptions","organizations_url":"https://api.github.com/users/ottlinger/orgs","repos_url":"https://api.github.com/users/ottlinger/repos","events_url":"https://api.github.com/users/ottlinger/events{/privacy}","received_events_url":"https://api.github.com/users/ottlinger/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-02-22T19:49:39Z","updated_at":"2016-02-22T19:49:39Z","closed_at":null,"body":"### Description\r\n\r\nIs it possible to provide md5 hashes to verify downloads from https://atom.io?\r\nThis would allow a checking/verification of the downloaded artifact.\r\n\r\n### Steps to Reproduce\r\n\r\n1. Visit https://atom.io\r\n2. Select a download\r\n\r\n**Expected behavior:** [What you expected to happen]\r\n\r\nI'd love to confirm that the downloaded contents is the same as the one that was published. \r\nOther big organizations such as Apache Software Foundation provide signatures, while other just print md5-hashes. \r\nThese could be integrated into the webpage or provided upon download as\r\n```\r\natom-amd64.deb\r\natom-amd64.deb.md5\r\n```\r\n**Actual behavior:** [What actually happened]\r\n\r\nYou just download a versionless \"potentially\" insecure file that is installed with root privileges.\r\n\r\n### Versions\r\n\r\n1.5.1\r\n"}}