[general_re]

I'm not sure how it would do so. On the client end, how does your machine know the proper filesize the first time it's downloaded? On the server end, how does the server know the proper filesize the first time it's uploaded?

After that, if the file is modified, then a Tripwire-type solution should catch it, I would think. In the mean time, everyone's checking those MD5 sums, right?

[proxy_user]

The tripwire daemon should be monitoring the size of the executables in /bin, not the downloaded file. Those are the normal targets, all the regular Unix commands that are run frequently.