no way to download Larceny safely

[jordanblack]

The website is unencrypted (http), no checksums with pgp/gpg keys are provided for releases, and the 0.98 source release from here (github, which is over https) is different from the source release on the main site (which isn't much help anyway since it requires itself for bootstrapping).

[WillClinger]

This concerns the release and distribution process and the web sites.

[WillClinger]

Checksums for the v0.98 binary releases (except ARMv7):

% md5sum *
3838232de0a603ddcacebae90a16e1c9  larceny-0.98-bin-native-ia32-linux86.tar.gz
4cab49ddc410bba6db0d7c8750b09738  larceny-0.98-bin-native-ia32-macosx.tar.gz
0c9d30714c851bab3c6cd62e87b88ac6  larceny-0.98-bin-native-ia32-win32.tar.gz
28b60307fc11128b6e15c327ff63fd20  larceny-0.98-bin-native-ia32-win32.zip
38e804d8eb2b8b1e43e2823abeefa68f  larceny-0.98-bin-native-ia32-winXP.tar.gz
d39b0f13eaca11e70b15594f6057f9e5  larceny-0.98-bin-native-ia32-winXP.zip

For source, I'd recommend cloning from the GitHub site.

[WillClinger]

It would be nice to automate this safety feature.