no automatic validation of extension packs

[hugh2]

Ideally the extension packs would be digitally signed like the main installer binary, with the signature checked by the main program when downloading a new extpack. (it wouldn't enforce a signature for a local file - you might want to write your own extpack)

If that is too hard it would at least be a big improvement to download them via https instead of http. At present download.virtualbox.org doesn't support https, and if you put https in front of dlc.sun.com.edgesuite.net it gives a certificate error.

Currently if you want to validate an extension pack you have to

• cancel the dialog that asks to update the extension pack
• open a web browser
• hunt around for the latest extpack (unless you can copy the URL from the dialog?)
• download it by http
• locate a hashing tool
• calculate the extpack's hash
• manually compare hash with that published on the website
• finally, if satisfied, manually install the extpack

[Frank Mehnert]

This is definitely a problem. Unfortunately the download server is currently not capable of providing the https protocol (work is going on to fix that). And yes, checking a package signature would be another option but is also not trivial, especially to get this working for all 4 supported hosts. I hope that the download server will be fixed during the next few months.

[aeichner]

Please reopen if still relevant with a recent VirtualBox release.