how to verify software is legit?

[accord01]

Or choose your operating system
windows Download for Windows (zip) ~13MB
windows Download for Windows (exe) ~9MB
ubuntu Download for Ubuntu (PPA) ~4MB
linux Download for Linux (tgz, 32/64-bit) ~12MB
osx Download for Mac OS X ~13MB

this is not right.  the .exe is 11.1 mb... not 9mb... somebody should go on bitcoin.org and change that.  it would be bad for a newbie to see such a simple mistake not go corrected.

so how do i verify that it is correct version and that sourceforge was not hacked and software manipulated?

Not sure how to verify pgp keys, the explanation is vague.

[RedRobin2442]

IF you cant figure out how to search for it, you shouldn't touch it. Not quite Warren Buffet, but you get the idea.

[PrintMule]

google up "md5 checksum"

it may answer some questions

[bee7]

You should download the client and get its sha256 check-sum (the check-sum of the file you downloaded)

Then compare this check-sum with the one listed here http://sourceforge.net/projects/bitcoin/files/Bitcoin/bitcoin-0.8.5/SHA256SUMS.asc/view

Also, you need to verify PGP signature of the message at http://sourceforge.net/projects/bitcoin/files/Bitcoin/bitcoin-0.8.5/SHA256SUMS.asc/view

The list of all developers and their PGP id's is here: http://bitcoin.org/en/development

All developers have their PGP id in its profiles on this forum

[michagogo]

Or choose your operating system
windows Download for Windows (zip) ~13MB
windows Download for Windows (exe) ~9MB
ubuntu Download for Ubuntu (PPA) ~4MB
linux Download for Linux (tgz, 32/64-bit) ~12MB
osx Download for Mac OS X ~13MB

this is not right.  the .exe is 11.1 mb... not 9mb... somebody should go on bitcoin.org and change that.  it would be bad for a newbie to see such a simple mistake not go corrected.

so how do i verify that it is correct version and that sourceforge was not hacked and software manipulated?

Not sure how to verify pgp keys, the explanation is vague.

Fixed: https://github.com/bitcoin/bitcoin.org/pull/270