A customer needs to verify a software package came from the publisher and was not altered. Which mechanism best fits?

1. Rely exclusively on the download URL's spelling
2. Compare file size only
3. Encrypt the package with the customer's public key only
4. Validate the publisher's digital signature