Unfortunately it's impossible for a user of Piwik to determine if he/she downloaded a legitimate and checked release of Piwik. The Piwik Website provides neither checksums nor signatures for the offered installation archives. Additionally installation archives have no clear names, which would enable the user to see the version of the release.

I know that Piwik takes security seriously and in my opinion this is a real issue.

If the releases are distributed in zip archives, the countermeasures could be:

• Before a release is published, the code could be copied to a standalone system and the integrity of the code could be tested in a documented way (for example by reviewing the code changes since the previous release).
• Afterwards the code could be archived and signed on that system.

Keywords: security gpg signing release packaging