Re: [GNU-linux-libre] Help users to verify their downloads

[Andreas Grapentin]

> so in short, checksums only verify that a download was received in tact 
> without
> error, while a GPG signature verifyies the authenticity of the person who
> published it - the level of confidence that i suspect this thread was asking 
> for
> can only be provided by a signature - checksums are far less significant and
> indeed optional when a signature is provuded; as the signature verifies the
> file's integrity also

I would like to add here that is quite common to sign the *checksum* of
a file, instead of the file itself. Since creating the signature is
computationally more expensive than (most) checksum algorithms, this
reduces the system load on both sides of the trust chain, while
providing basically the same result.

-A


-- 

------------------------------------------------------------------------------
my GPG Public Key:                 https://files.grapentin.org/.gpg/public.key
------------------------------------------------------------------------------

signature.asc
Description: PGP signature