Re: [GNU-linux-libre] Help users to verify their downloads

[bill-auger]

for the benefit of anyone reading who is not entirely familiar with these tools
mentioned (md5, sha, gpg) - allow me to make some important distinctions - if
the concerned users who prompted this thread are not reading this list, i
suggest someone should bring these distinctions to their attention

on the one hand there are checksums, often in files named MD5SUMS, SHA256SUMS,
and similar - these are mainly useful to verify that the downloaded files are
complete and were not damaged in transit - downloading over bittorrent offers
this same level of robustness intrinsically without the separate checksum file,
thus releiving the user of that manual step - however, this is a very weak form
of validation in respect to the concern donald raised - anyone with a completed
download could modify it and create a new checksum that will match the modified
file - that is also possible on a torrent network (the checksums are in the
.torrent file); but the result would be two clearly distinguishable and
unrealated files with each coupled to their own .torrent metadata file - if any
case, there is no way to know who authored that file or it's metadata

on the other hand, files that were signed with a GPG key are attributable to the
person who authored it; even if it is delivered over some other channel by some
other person - the GPG key of the person who signed the file can be verified
against the list of official developers as published on the distro's website -
the signature will be as valid whether the file was downloaded directly from the
distro's website, or over bittorrent, or from any other source - if someone
modifies that file and then publishes the modified version, the original
signature of the distro developer would not be valid against the modified
version - that person could sign it with their own GPG key; but that would
obviously be not one of the official keys published on the distro's website 

so in short, checksums only verify that a download was received in tact without
error, while a GPG signature verifyies the authenticity of the person who
published it - the level of confidence that i suspect this thread was asking for
can only be provided by a signature - checksums are far less significant and
indeed optional when a signature is provuded; as the signature verifies the
file's integrity also

signature.asc
Description: This is a digitally signed message part