It's awesome that Npackd calculates SHA256 sum of each downloaded package and compares it to the one a maintainer provided. It increases the probability that the package was not intercepted and swapped. But it would be better if SHA256 sums provided by package developers were used.
Npackd could have additional fields for each package that would detect a SHA256 sum.
E.g. for 64bit qBitTorrent the discovery page would be https://www.qbittorrent.org/download.php and the discovery regular expression would be 64-bit\sinstaller</td>\s*<td\sclass="wordBreak">\s*<code>([a-f\d]+). For other packages (like KeePassXC) it would have to download a .txt file and get SHA256 from it.
I wanted to try to code it myself but wasn't able to build Npackd by following BUILD.txt.
It's awesome that Npackd calculates SHA256 sum of each downloaded package and compares it to the one a maintainer provided. It increases the probability that the package was not intercepted and swapped. But it would be better if SHA256 sums provided by package developers were used.
Npackd could have additional fields for each package that would detect a SHA256 sum.
E.g. for 64bit qBitTorrent the discovery page would be
https://www.qbittorrent.org/download.phpand the discovery regular expression would be64-bit\sinstaller</td>\s*<td\sclass="wordBreak">\s*<code>([a-f\d]+). For other packages (like KeePassXC) it would have to download a .txt file and get SHA256 from it.I wanted to try to code it myself but wasn't able to build Npackd by following BUILD.txt.