How to verify integrity of software when the download provider doesn't publish hashes?

Question

I noticed that certain software does not provide hash anymore nowadays.

E.g.

1. Zoom

https://zoom.us/download

wolf@linux:~$ ls -lh zoom_amd64.deb 
-rw-rw-r-- 1 wolf wolf 44M Jan   1 00:00 zoom_amd64.deb
wolf@linux:~$ 

I've googled both md5 and sha256 hashes but couldn't find it.

wolf@linux:~$ md5sum zoom_amd64.deb 
5f452b11d86d41e108a32f6a7d86c6dc  zoom_amd64.deb
wolf@linux:~$ 
wolf@linux:~$ sha256sum zoom_amd64.deb 
b06bc30a53ac5d3feb624e536c86394ccb9ac5fc8da9bd239ef48724138e9fc1  zoom_amd64.deb
wolf@linux:~$ 

2. Microsoft Teams

https://www.microsoft.com/en-my/microsoft-teams/download-app#desktopAppDownloadregion

wolf@linux:~$ ls -lh teams_1.3.00.30857_amd64.deb 
-rw-rw-r-- 1 wolf wolf 73M Jan  20 09:07 teams_1.3.00.30857_amd64.deb
wolf@linux:~$ 
wolf@linux:~$ md5sum teams_1.3.00.30857_amd64.deb 
3d738e013804b96f401bd274db4069d1  teams_1.3.00.30857_amd64.deb
wolf@linux:~$ 
wolf@linux:~$ sha256sum teams_1.3.00.30857_amd64.deb 
5058b1fe8bf9fffc57d94148a7ec55119c5cd9b21aa267cb13518bec0244241b  teams_1.3.00.30857_amd64.deb
wolf@linux:~$ 

How do we verify software like this to make sure nobody has ever tampered with it?

Answer 1

I think you need to ask Zoom directly why they don't provide hashes and/or signed builds. The DEB package itself still contains md5sums of all files but this is mostly useful for post install verification not protection against malicious intentions. Note that publishing hashes of tarballs also doesn't help with that -- if someone manages to put a "fake" tarball/package on Zoom servers they could also put a fake hash there. Hashes are usually used to make sure the tarball or package (or ISO for distributions) was not corrupted during download. Signed releases provide some sort of "security" but you still have the problem of getting the public key to verify the signature which you usually get from the same source.

Btw. Zoom is closed source and closed source projects IMHO usually don't do this. We should be glad they provide RPM and DEB packages :-)