checksum doesn't match

Question

Thanks for the free product.

I downloaded version 9 from the Sophos website but the checksum for the file savosx_90_he.zip doesn't match the one here:

http://openforum.sophos.com/t5/Sophos-Anti-Virus-for-Mac-Home/Checksums-for-savosx-90-he-zip/m-p/14719/highlight/true#M6851

The link to the checksums in this post comes back file does not exist.

openforum.sophos.com/.../39

This was after the first 2 tries at downloading gave me zip files that wouldn't open and returned the message "Unable to archive . . . Error 1 - Operation not permitted." Console said "ditto: Sophos Anti-Virus Home Edition.app/Contents/Install/Root/vdl/c8aea79d16c1cf0467ec24827f20b667b575a05e60b3d9f787199db480278507: No such file or directory" and "ditto: couldn't read pkzip signature".

The 3rd time I downloaded it, it opened and gave me a file called "Sophos Anti-Virus Home Edition.app". I was expecting a dmg file, so this also seemed odd.

I'm trying to install to a Mac Mini running Snow Leopard. I have version 8 on my MB Pro with Snow Leopard and it works fine. I see I have to upgrade to Version 9 soon and I want to make sure the program is safe to install. Feeling a little unsure with the recent Heartbleed exploit in the news.

Thanks for your help.

This thread was automatically locked due to age.

bobcook · Accepted Answer

gail2 wrote: 
 I downloaded version 9 from the Sophos website but the checksum for the file savosx_90_he.zip doesn't match the one here 
 
 We update the installer approximately once a month, which means the checksums posted back in November (in that post you linked to) would have been replaced.

The current version posted to the website is 9.0.8 and checksum:

6a871dbcef238f4fdbb8f068ac556691abb965a430e6fce0061d735404f352ae SophosHomeEditionInstaller.zip

Note that we'll be updating the posted version to 9.0.10 soon, its checksum will be:

8811cb29c16e6da6875fdb0002abda7e1b17e2e43f7f3ae6105d85898805cfbf SophosHomeEditionInstaller.zip 
 gail2 wrote:
 The 3rd time I downloaded it, it opened and gave me a file called "Sophos Anti-Virus Home Edition.app". I was expecting a dmg file, so this also seemed odd. 
 
 This is correct (after its expanded from the .zip). We don't package it using a DMG any longer starting with version 9.0, our installer is an application that you can simply double-click. If you have any doubt to its authenticity you can check the digitial signature via the command line:

codesign -dvv "Sophos Anti-Virus Home Edition.app" 
 and this will tell you if its signed (it is) and whether the code signatures are valid e.g. not been tampered with. This is what it said for me, run against 9.0.8:

$ codesign -dvv "Sophos Anti-Virus Home Edition.app"
Executable=/Users/bobcook/Downloads/Sophos Anti-Virus Home Edition.app/Contents/MacOS/Installer
Identifier=com.sophos.macendpoint.Installer
Format=bundle with Mach-O universal (i386 x86_64)
CodeDirectory v=20100 size=781 flags=0x0(none) hashes=32+3 location=embedded
Signature size=4205
Authority=Developer ID Application: Sophos
Authority=Developer ID Certification Authority
Authority=Apple Root CA
Signed Time=2014-02-05 10:46:36 AM
Info.plist entries=23
Sealed Resources rules=5 files=83
Internal requirements count=1 size=288

We are looking into a better way to get this information posted regularly. :1017003