Linux Questions

4165 readers

1 users here now

Linux questions Rules (in addition of the Lemmy.zip rules)

stay on topic
be nice (no name calling)
do not post long blocks of text such as logs
do not delete your posts
only post questions (no information posts)

Tips for giving and receiving help

be as clear and specific
say thank you if a solution works
verify your solutions before posting them as facts.

Any rule violations will result in disciplinary actions

founded 3 years ago

MODERATORS

possiblylinux127@lemmy.zip

Validating hashes and signatures? (eviltoast.org)

submitted 4 days ago by korazail@eviltoast.org to c/linuxquestions@lemmy.zip

4 comments fedilink hide all child comments

Relatively Linux Newbie here. Been playing with flavors of Linux/Unix/BSD for a few decades but only recently moved to having one as my primary OS.

My question is: Since I don't think of myself as a person of interest, is there a solid reason to do things like validate hashes or signatures when I get packages from a non-standard repo?

For example, I want to do something with a tool that doesn't have it's own repository. They have a website with a .deb or .tar.gz download and an accompanying signature file or hash. There are instructions for grabbing the public key from their domain so I can verify the file or there is a hash text string.

I can go verify a hash or signature... but if I got the file and the signature from the same place . . . If an attacker wanted to hand me bad code, couldn't they also hand me a bad signature/certificate/key?

If I was given a flash drive with a tool by a random person, then I might want to validate it, but if I download a file from an org that I went to on purpose then the org giving me their key doesn't seem to do much. Aside from file corruption, there's nothing to prove and a corrupted file is likely to fail in other ways such as a .gz checksum.

I'm not saying the practice is bad. But if I'm not important enough to have someone waiting to intercept my random app download and give me a backdoored version and I trust the developer to not be giving me malware in the first place, is there a need to verify?

you are viewing a single comment's thread
view the rest of the comments

[–] thoughtfuldragon@lemmy.blahaj.zone 2 points 4 days ago* (last edited 4 days ago)

well for the signature, if you have the key, and the author signs future releases with the same key then if an attacker ever compromises the download page but not the signature then the signature won't match the key you already have. This is also part of what makes repositories better than a plain .deb because the key and so on is fetched and then checked by the update tool automatically ever after. The point isn't to protect people of interest. It is assumed that a dedicated attacker will find a way. It is to prevent wide net attacks that discriminate less and decide what to do with who gets compromised after the compromise.

The hash is mainly so you can verify file integrity, i.e. that the file on your disk is the same one that the website offered. It doesn't provide any claims about authorship or security. So you don't end up writing half an ISO to your thumbdrive and wondering why it won't boot or something.