Menu▾▴
Verifying downloaded files
File hashes or checksums are cryptographic strings generated from the file itself, which you can verify on your end to ensure that the file you are downloading hasn't been tampered with somewhere between us and the mirror, or between the mirror and you.
Project developers may also find it useful to use checksums to verify that the upload process went smoothly and that the file on our servers after the upload is the same as the file on your computer.
Finding checksums on the SourceForge site
In the file's interface, click on the 
information icon next to the file, and you'll see two strings labeled SHA1 and MD5.
Generating checksums from a downloaded file
Once you have downloaded the file, generate the MD5 checksum, or SHA1 checksum, of that file, and compare what you get to what we list on the site. If they don't match, notify us, then try downloading from a different mirror.
Via the web
There are several sites that you can use to generate a hash. Here are some we've used before:
Windows
On Windows, we recommend a tool like fHash to generate the hashes from the downloaded file. There are also browser plugins that will calculate the checksums on a file as you download it so that you're less likely to forget to do it yourself.
Mac OS X
On Mac OS X, at the terminal:
$md5download.tar.gzMD5(download.tar.gz)=84a3d6aa561b112058ad9aa08a352044$shasumdownload.tar.gzb6133cbc973faf908f83fa950574db0fa268480cdownload.tar.gzLinux
On Linux, at the command line:
$md5sumdownload.tar.gz84a3d6aa561b112058ad9aa08a352044download.tar.gz$sha1sumdownload.tar.gzb6133cbc973faf908f83fa950574db0fa268480cdownload.tar.gzLimitations
For users, this test will only determine whether or not the file matches what is stored on our master mirror server. If the file was corrupted when the project developer uploaded the file, this will not detect that.
Again, if you discover that a checksum doesn't match, pleasenotify us so that we can do something about it as quickly as possible.
