What is the Engine download verification process for Update Downloader?

Update Downloader has an internal process in place for verification of the engine downloads.

Why

The verification is done to avoid supply chain attacks when downloading the engines.

How

1. First validation: Before downloading the database files, the downloader will check the signature of the database YAML first to ensure that it is from OPSWAT and that there are no modifications.
2. Second validation: After the downloading the database, a hash comparison will be conducted to verify each database’s file against the entries in the YAML file to ensure that no modifications are made on individual files. If everything is good, the downloader will recompress to a new database zip package.
3. Third validation: When uploading to MD Core, Core will validate every single file inside the database.zip package with the YAML one more time to make sure that these are from OPSWAT.