dionyziz/oh-my-zsh — pull request #1 by dionyziz (2014-12-31 09:33:27+00:00)
Title: Provide downloaded scripts checksums for security

As reported in #3459, the README file suggests an insecure download and
execution via HTTP instead of HTTPS. It is very easy to switch to HTTPS:
You can get a free certificate nowadays:

https://www.startssl.com/

However, before the migration to HTTPS is completed, this patch adds
checksums that will allow users to verify the authenticity of their
download.

The authenticity of the checksums is assumed because it will be viewed
on an https-served GitHub page on the correct author username
(robbyrussell).

I have verified this checksum by downloading the HTTP script from two
different network topologies and also visually inspecting that the
script is not malicious. I have also compared it with the HTTPS-served
script at this location and found it to be identical:

https://raw.githubusercontent.com/robbyrussell/oh-my-zsh/master/tools/install.sh

This commit is signed with my GPG-key for authenticity.

The reviewer should also verify the checksum is correct.

Thanks for helping keep users secure.

Fixes #3459