Tag Archives: Tips and Tricks

Verifying Downloaded Files

When you download a file from SourceForge (or, indeed, from anywhere), there are often mechanisms for verifying that you’ve downloaded the right thing – ie, that nobody has tampered with the file, and that you’re getting what the developers intended for you to download.

The most common way to do this is with a file hash that gets generated with the file is created.

Verifying downloaded files

Each time a file is uploaded, we generate an MD5 hash, and a SHA1 hash of that file, so that you can quickly check whether a file has been tampered with.

In the files interface, click on the “I” information icon next to the file, and you’ll see, as in the image above, two strings labelled SHA1 and MD5. These are cryptographic strings generated from the file itself, which you can verify on your end to ensure that the file you are downloading hasn’t been tampered with somewhere between us and the mirror, or between the mirror and you.

We will also, very soon, be adding those checksum strings to the file download page itself, so that you don’t have to go out of your way to look for it.

Once you have downloaded the file, check to see that the MD5 checksum, or SHA1 checksum, of that file, matches what we list on the site. If they don’t match, notify us, then try downloading from a different mirror.

On Windows, we recommend a tool like md5deep to generate the hashes from the downloaded file. There are also browser plugins that will calculate the checksums on a file as you download it, so that you’re less likely to forget to do it yourself.

On Linux, at the command line:

$ md5sum download.tar.gz
84a3d6aa561b112058ad9aa08a352044  download.tar.gz

$ sha1sum download.tar.gz
b6133cbc973faf908f83fa950574db0fa268480c  download.tar.gz

On Mac OS X, at the terminal:

$ md5 download.tar.gz
MD5 (download.tar.gz) = 84a3d6aa561b112058ad9aa08a352044

$ shasum download.tar.gz
b6133cbc973faf908f83fa950574db0fa268480c  download.tar.gz

Again, if you discover that a checksum doesn’t match, please tell us so that we can do something about it as quickly as possible.

We also strongly encourage project admins to verify your files yourselves on various mirror servers, after you’ve uploaded them, ensuring that what’s on the server matches what you uploaded.


One great way to both attract new users to your project is by providing it in their language. The added ease of reading documentation and user interface elements in one’s own language takes a lot of the stress out of learning a new piece of software, and can quickly distinguish your product over others in the same space, even those with similar or even better features.


But, if you aren’t multilingual, how do you go about it? Well, it also appears that providing a mechanism for translation attracts new developers and contributors to your community, because it’s something that’s easy for people to do if they speak another language than the one in which the project was written.

As a citizen of the United States, I’m aware that I’m a part of a tiny percentage of the world who is not multi lingual. I used to live in Kenya, and the old joke went something like:

What do you call someone who speaks two languages? Bilingual.
What do you call someone who speaks three languages? Trilingual.
What do you call someone who speaks one language? American.

But most of the rest of the world speaks at least two, and usually more, languages. So translating a few user interface components, or a page of the documentation, isn’t a huge investment in time or effort, so it’s an easy way for someone to get involved in a project.

There are several resources for projects wishing to have translations done. By using one of these services, you can reduce the effort required for someone to contribute translations, without having to learn about your particular documentation format, your revision control system, or even know much about your product.

The Pootle project is a SourceForge project is a web-based translation tool. The tool itself is available in numerous languages, and the project website offers extensive resources about making your project translation-ready. The earlier in your project’s life you read this stuff, the more work you’ll save for yourself later.


Launchpad has a free service that coordinates translation for projects, and is used by a large number of projects, so has an interface that potential translators may already be familiar with. It’s easy to register your project there, but you’ll need to do some initial work to make your project translation-ready. Having text in the code, rather than in resource files, makes translation more complicated. Likewise, your documentation should be in formats that are portable between operating systems, and not tied to a particular application that someone might not have.


DuoLingo looks like an interesting approach, but hasn’t yet launched, so I can’t really comment on how it works.

Get Localization was another service that was recommended to me, but which I haven’t used myself.