Besides the question why curl is called with CURLSSLOPT_NO_REVOKE there is no validation whatsoever on the downloads. The update file is just downloaded and feed into ShellExecute().
In contrast, when I download the update manually there are plenty of signature files to check against. It is somewhat unexpected to find that an automated tool like WinGUp seems to be totally free of that burden and just skips that part.
Besides the question why curl is called with CURLSSLOPT_NO_REVOKE there is no validation whatsoever on the downloads. The update file is just downloaded and feed into ShellExecute().
In contrast, when I download the update manually there are plenty of signature files to check against. It is somewhat unexpected to find that an automated tool like WinGUp seems to be totally free of that burden and just skips that part.