Re: [GNU-linux-libre] Help users to verify their downloads

[Ineiev]

On Mon, Jun 18, 2018 at 08:47:11PM -0400, bill-auger wrote:
> on the one hand there are checksums, often in files named MD5SUMS, SHA256SUMS,
> and similar
...
> anyone with a completed
> download could modify it and create a new checksum that will match the 
> modified
> file 
...
> on the other hand, files that were signed with a GPG key are attributable to 
> the
> person who authored it
...
> the original
> signature of the distro developer would not be valid against the modified
> version - that person could sign it with their own GPG key; but that would
> obviously be not one of the official keys published on the distro's website 

Perhaps you should also explain how MITMing files with checksums on distro's
site differs from MITMing the official keys on the same site.

signature.asc
Description: Digital signature