This question already has an answer here:
I am working a lot with vagrant boxes and virtual machines and software outside of the OS repositories.
I downloaded the file
hadoop-2.7.3.tar.gz. To check its integrity I need to validate against
hadoop-2.7.3.tar.gz.mds. As both files are downloaded via unsecure transport, and the domain is not available via TLS - how does this even work, when the binary and the signatures could be faked?