When you download a file, make note of the checksum for that file as indicated on the download page. It will either be a 32-digit MD5 checksum, or a 40-digit SHA1 checksum. The easiest way to do this is probably just to leave your browser window open until after you've completed the check. After your download is complete, follow these steps to verify the checksum on the file:

1. Open the Terminal application (stored in the "Utilities" folder inside the "Applications" folder on your startup disk).
2. If the checksum is a 32-digit MD5 checksum at the Terminal command prompt, type this instruction, followed by a space:

   /sbin/md5

   Do not press return. The space is important because it will separate the command name (md5) from the file that you'll be testing. If the checksum is a 40-digit SHA1 checksum type the following, followed by a space:

   /usr/bin/openssl sha1

3. Using the mouse, find the downloaded file and drag it onto the Terminal window. The full path to the downloaded file will appear in the window.
4. Switch back to the Terminal window, and press the return key to actually issue the command.
5. Compare the checksum string that is displayed in the Terminal window with the corresponding string on the website. It should be an exact match (all digits exactly the same).

If there is a discrepancy, then something has gone wrong with your download, or the file has been tampered with. Try performing the comparison again, or re-downloading. If you think you've discovered evidence of tampering, please contact me.

If you would like to learn more about the md5 command and the MD5 algorithm itself, issue this command in the Terminal and press return:

man md5

To learn more about SHA1, issue this:

man sha1