The tripwire daemon should be monitoring the size of the executables in /bin, not the downloaded file. Those are the normal targets, all the regular Unix commands that are run frequently.
Ah, sorry - I thought you were asking about the moz/TB binaries. In that case, Tripwire would presumably sound the alarm if files started changing.