32-bit
exemachine scopecygwin.com · publisher domain- SHA-256
- 1b1f8080cf9ed3a9da8ed5560ff59e658941bbcc31ba01b2f5ae36026c9b1594
- Silent install
- --quiet-mode hidden --site "https://mirrors.kernel.org/sourceware/cygwin/"
Cygwin
by Cygwin · GPL-3.0
100/100how this is calculated
A large collection of GNU and Open Source tools which provide functionality similar to a Linux distribution on Windows.
Record
- Latest version
- 3.6.9-1
- Official page
- https://www.cygwin.com/
- Package identifier
- Cygwin.Cygwin
- Command
- cygwin
Official downloads
These URLs are the ones Cygwin declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
32-bit
exeuser scopecygwin.com · publisher domain- SHA-256
- 1b1f8080cf9ed3a9da8ed5560ff59e658941bbcc31ba01b2f5ae36026c9b1594
- Silent install
- --quiet-mode hidden --site "https://mirrors.kernel.org/sourceware/cygwin/"
64-bit
exemachine scopecygwin.com · publisher domain- SHA-256
- 2c9f2fb56e1fb687b5d9680afa8f8b06e6214f0e483096af0eae1946431226c5
- Silent install
- --quiet-mode hidden --site "https://mirrors.kernel.org/sourceware/cygwin/"
64-bit
exeuser scopecygwin.com · publisher domain- SHA-256
- 2c9f2fb56e1fb687b5d9680afa8f8b06e6214f0e483096af0eae1946431226c5
- Silent install
- --quiet-mode hidden --site "https://mirrors.kernel.org/sourceware/cygwin/"
Verify the file you downloaded
Run this against the file on disk. If the output does not match the hash below, the file is not what Cygwin published. Delete it.
Windows · PowerShell
Get-FileHash "setup-2.937.x86_64.exe" -Algorithm SHA256macOS · Linux
shasum -a 256 "setup-2.937.x86_64.exe"Expected output
2c9f2fb56e1fb687b5d9680afa8f8b06e6214f0e483096af0eae1946431226c5
How we scored this 100 out of 100
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 4 of 4 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 4 on the publisher's own domainThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 4 of 4 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Licence declared | GPL-3.0A declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Version history3 on record
Every version with a published manifest, newest first. Useful when you need an older build for compatibility.
- 3.6.9-1
- 3.5.7
- 3.4.9