Do you really think it will be hard for the US gov to make sourceforge put backdoored binaries up on the only mirror we have today?
Fixed that for ya
We would notice within hours if they did that. You see, the SHA-1 hashes of all official releases are PGP signed by a trusted developer, and people DO check them every now and then. It'd be great if we had a bot check them, though.
Thats good. I was surprised that it seemed like they are not. Would be good to use two different hashes or at least not sha-1 anymore. Also, it is not obvious at all from the bitcoin.org page. I just see link to downloads of the binaries, where are the links to the signatures?