iRedMail will check MD5 during installation, but if you download files separately, you have to verify it manually.

You can also download the latest version on bitbucket.org:
Http://bitbucket.org/zhb/iredapd/downloads

Same as iRedAPD, you have to verify it manually.

I will upload iRedAdmin on bitbucket.org later. (sick today, please give me some time)

Download the package from http://www.iredmail.org/yum/misc/, then find the MD5 code in file shipped in iRedMail: pkgs/MD5.misc (or pkgs/MD5.openbsd, SHASUM.freebsd).
Or, download them separately from bitbucket.org project page.

Man in the middle?
If you download from bitbucket.org and the file is modified by someone, then bitbucket.org is hacked.

As I assume we all know, it is trivial to manipulate unauthenticated packets in transit as is demonstrated by the Upsidedownternet page.

However, a careful review of the method used reveals that, simply checking the download with the MD5 function is not sufficient to guard against deliberate tampering. The reason is that MD5 is no longer considered cryptographically secure. There is even software available to generate MD5 collisions.

SHA-1 is better, but considered depricated.

Edit: Slight correction: it is apparently easier to generate two matching files, than to generate a second file maching one that can not change. In other words, in the case of a malicious MD5 collision, we are likely taking about a server compromise anyway.

*) Updating iRedMail doesn't require the latest iRedMail installer. Please follow our tutorial here: http://www.iredmail.org/docs/iredmail.releases.html

*) Downloading packages doesn't send/receive any sensitive info (e.g. no username/password submitted), so http:// is ok in this case. We will switch to https soon.

As mentioned in my previous reply, we will make it work under https only soon.

Hi! Is there any progress on switching to https?

I'm trying to download everything from BitBucket to avoid http, but iredadmin-ose is only tagged until 0.6.3. I tried to use the tip version, but then I got this:

$ bash upgrade_iredadmin.sh 

* Detected Linux/BSD distribution: UBUNTU
* HTTP server root: /usr/share/apache2
* Found iRedAdmin directory: /usr/share/apache2/iredadmin, symbol link of iRedAdmin-0.6.1
* Found iRedAdmin config file: /usr/share/apache2/iredadmin/settings.py
<<< ERROR >>> Cannot find new version of iRedAdmin in current directory. Exit

even if the ChangeLog file lists 0.8, 0.7 and 0.6.3, 0.6.2 and 0.6.1.

I found out my issue. I got iredadmin-ose 0.7.0 using mercurial from bitbucket, but I forgot to rename it to iRedAdmin-0.7.0. The update script checks the folder name to know which version it is. That's why I got the "Cannot find new version of iRedAdmin in current directory" error.

About the https issue, personally I would suggest moving to a mercurial based workflow. Instead of suggesting to download tar.gz files, then uploading them to the server, unpacking them, and running scripts, it would be much easier to do "hg clone" directly on our servers. When there's a new version, we could do "hg update versionX" on the server, and run the updated code. Maybe you would save time packaging files, and it might make updating a bit simpler and more secure.

Cheers