takluyver/pynsist — pull request #12 by devsnd (2014-04-11 15:27:59+00:00)
Title: use hashes to check file integrity instead of gpg

The gpg check automatically imports keys that shouldn't necessarily be trusted and uses them to verify the the python installer. But since they can't really be trusted, I suggest to use hashes instead to verify the integrity of the files. (Most linux distributions sign their packages, so we can assure that the hash hasn't been tampered with). This also means that the library is more portable and does not rely on having gpg installed to verify the contents of the downloaded files.