LFL safely read the ZIP central directory without extracting or executing anything. This list is what the archive declares; the SHA-256 identifies the exact download, but only a full download and CRC check can prove every file is intact.