2

I've noticed when I go to download modules from some extension providers that they include the SHA-1 Signature, for example

Module Example v1.2.1

File size: 34.18 Kb SHA1 Signature: c7a8ffa0503bb59320ef40c1f559e4fa36fb2092 Compatibility: Joomla 3.0 |Download now| |Direct Link|

What is the 'SHA1 Signature' - how is it used by the extension developers and/or the Joomla! CMS?

Improve this question

2 Answers 2

Reset to default
3

The number is a hash value or a Checksum.

A hash value processed on the downloaded file is a way to make sure that the content is transferred OK and has not been damaged during the download process.

What is SHA?

SHA stands for "secure hash algorithm". The four SHA algorithms are structured differently and are named SHA-0, SHA-1, SHA-2, and SHA-3. SHA-0 is the original version of the 160-bit hash function published in 1993 under the name "SHA": it was not adopted by many applications. Published in 1995, SHA-1 is very similar to SHA-0, but alters the original SHA hash specification to correct alleged weaknesses. SHA-2, published in 2001, is significantly different from the SHA-1 hash function.

(Wikipedia)

Basically, it's a "fingerprint" or a checksum of the file, and the purpose is to allow a user to make sure the original, unaltered file has been downloaded. This helps avoid corrupt downloads, and files modified by third parties. There are many algorithms to generate a checksum, and SHA1 is only one of them (MD5 is another common variant).

A unique number (often called checksum) is generated based on the file contents. The end user can pass the downloaded file through a program to get the checksum, and if the file is identical to the original file, the checksum will also be the same. Even the smallest change to the file will give a different checksum. Note that different algorithms will produce different checksums, you can't compare a MD5 checksum or a SHA2 checksum with a SHA1 checksum.

Resources

Improve this answer
0
0

SHA-1 is now, insecure. Not recommended in 2022.

Improve this answer
1
  • 1
    This answer has been auto-flagged by the system as low-quality due to its length. I would like to note as well that this answer does not attempt to answer: "What is the 'SHA1 Signature' - how is it used by the extension developers and/or the Joomla! CMS?" You can very easily post your correct insight as a comment under the question or edit your answer to better address the specific question asked. Relevant insights are good and important, but all answers must attempt to answer the asked question. Thank you for contributing.
    – mickmackusa
    Commented Feb 11, 2022 at 18:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.