4 ms·

Incredibly, there does not appear to be any way whatsoever to securely verify downloads from respected openSUSE. Seriously? the author has no idea what they're

Incredibly, there does not appear to be any way whatsoever to securely verify downloads from respected openSUSE. Seriously? the author has no idea what they're talking about http://software.opensuse.org http://software.opensuse.org "For each ISO, we offer a checksum file with the corresponding SHA256 sum. For extra security, you can use GPG to verify who signed those .sha256 files. It should be 22C0 7BA5 3417 8CD0 2EFE 22AA B88B 2FD4 3DBD C284." https://en.opensuse.org/openSUSE:Tumbleweed_installation https://en.opensuse.org/openSUSE:Tumbleweed_installation http://download.opensuse.org/tumbleweed/iso/openSUSE-Tumbleweed-DVD-x86_64-Current.iso.sha256 http://download.opensuse.org/tumbleweed/iso/openSUSE-Tumblew... http://download.opensuse.org/tumbleweed/iso/openSUSE-Tumbleweed-DVD-i586-Current.iso.sha256 http://download.opensuse.org/tumbleweed/iso/openSUSE-Tumblew... http://download.opensuse.org/distribution/leap/42.1/iso/openSUSE-Leap-42.1-DVD-x86_64.iso.sha256 http://download.opensuse.org/distribution/leap/42.1/iso/open... http://download.opensuse.org/distribution/leap/42.1/iso/openSUSE-Leap-42.1-NET-x86_64.iso.sha256 http://download.opensuse.org/distribution/leap/42.1/iso/open... All signed, happy and healthy...and regularly checked.. people really should double check before making statements like this..

tyho 10y ago
All signed, with the signature keys delivered over HTTP, just as the site states.
- rbrownsuse 10y ago
  the site states that openSUSE does not sign it's checksums or provide instructions on how to verify them Both claims are demonstrably false.
- detaro 10y ago
  https://software.opensuse.org/ https://software.opensuse.org/ offers the GPG fingerprint over HTTPS. A bit curious that they don't enforce HTTPS for this page, but it is there. And the key has been the same for years, so there are quite a few independent sources quoting it, which helps to verify it.

tyho 10y ago

All signed, with the signature keys delivered over HTTP, just as the site states.

rbrownsuse 10y ago
the site states that openSUSE does not sign it's checksums or provide instructions on how to verify them Both claims are demonstrably false.
detaro 10y ago
https://software.opensuse.org/ https://software.opensuse.org/ offers the GPG fingerprint over HTTPS. A bit curious that they don't enforce HTTPS for this page, but it is there. And the key has been the same for years, so there are quite a few independent sources quoting it, which helps to verify it.