Linux Questions

4165 readers

1 users here now

Linux questions Rules (in addition of the Lemmy.zip rules)

stay on topic
be nice (no name calling)
do not post long blocks of text such as logs
do not delete your posts
only post questions (no information posts)

Tips for giving and receiving help

be as clear and specific
say thank you if a solution works
verify your solutions before posting them as facts.

Any rule violations will result in disciplinary actions

founded 3 years ago

MODERATORS

possiblylinux127@lemmy.zip

Validating hashes and signatures? (eviltoast.org)

submitted 5 days ago by korazail@eviltoast.org to c/linuxquestions@lemmy.zip

4 comments fedilink hide all child comments

Relatively Linux Newbie here. Been playing with flavors of Linux/Unix/BSD for a few decades but only recently moved to having one as my primary OS.

My question is: Since I don't think of myself as a person of interest, is there a solid reason to do things like validate hashes or signatures when I get packages from a non-standard repo?

For example, I want to do something with a tool that doesn't have it's own repository. They have a website with a .deb or .tar.gz download and an accompanying signature file or hash. There are instructions for grabbing the public key from their domain so I can verify the file or there is a hash text string.

I can go verify a hash or signature... but if I got the file and the signature from the same place . . . If an attacker wanted to hand me bad code, couldn't they also hand me a bad signature/certificate/key?

If I was given a flash drive with a tool by a random person, then I might want to validate it, but if I download a file from an org that I went to on purpose then the org giving me their key doesn't seem to do much. Aside from file corruption, there's nothing to prove and a corrupted file is likely to fail in other ways such as a .gz checksum.

I'm not saying the practice is bad. But if I'm not important enough to have someone waiting to intercept my random app download and give me a backdoored version and I trust the developer to not be giving me malware in the first place, is there a need to verify?

you are viewing a single comment's thread
view the rest of the comments

[–] moonpiedumplings@programming.dev 2 points 4 days ago

If an attacker wanted to hand me bad code, couldn’t they also hand me a bad signature/certificate/key?

This is what multi-party key signing is for. Now, multiple people verify code, and also verify build artifacts. Rather than trusting an individual, you trust a process during which developer's continuously verify each other.

The other thing to note is that the builder is not always the distributor. For example many Linux distro's have mirrors setup, where they share their built artifacts to other institutions and hosters, who then redistribute code.

Even for a single party, key signing has value because it ensures that everything after the original creation of the artifacts is not compromised, as long as the key distribution system is different than the distribution system of the artifacts.

But for a solo dev on Github, yes. Signing doesn't really do anything, since the developer and the distribution chain are close enough that it's highly likely the key would be compromised along with the source.