Scenario
--------

You have a launcher for some software, it allows you to execute the software but it will also allow you to switch versions and upgrade to newer versions.

When the launcher is executed, it downloads a manifest file from a specific URL (built into the launcher) to fetch the current list of versions. If there is a newer version, the user is notified and can update. If they decide to update to the new version it will pull another manifest from the same host as before, this is the manifest for the specific version.

This file contains a list of file names contained within this version and their respective SHA1 hashes. The patcher will then connect to the same host again to download files whose hashes do not match the local copies.

All manifest files and file objects for each version are stored within a single S3 bucket in this example. All requests are made over HTTPS to gzipped files.

Flaws?
------

I feel like this would be open to attacks due to semi-automatic downloading of executables. I don't know where an attacker could get in though. Should all files on the remote server be signed? Or will verifying the file contents with the SHA1 hashes provided by the server be enough?

Is there anything I can do to keep this safe, or should this kind of technique be avoided completely?