SourceForge

[John Ralls]

> On Jul 29, 2016, at 11:52 AM, davelist at mac.com wrote:
> 
> I know gnucash has used SourceForge for years but it's gone down hill over the years. I assume the gnucash developers are aware of this, but just in case, I wanted to share these links.
> 
> https://glyph.twistedmatrix.com/2016/07/dont-trust-sourceforge.html
> 
> http://www.howtogeek.com/218764/warning-don’t-download-software-from-sourceforge-if-you-can-help-it/
> 
> I'm not trying to start a problem - just sharing news in case people aren't aware.

Old news and supposedly fixed. But for the paranoid we've been providing another download link on Github in recent releases as well as including a README on SourceForge with the sha256 for the tarballs. SourceForge itself provides MD5 hashes (yeah, I know) on the download page so you can check if the file is altered. Given your email address I'll also mention that the Mac application bundle is code signed with an Apple developer certificate.

Regards,
John Ralls