4 ms·
Yes indeed. Qubes has a good article on verifying distribution images not only with checksums but also with cryptographic signatures that verify the checksum fi
by zvmaz 1y ago
Yes indeed. Qubes has a good article on verifying distribution images not only with checksums but also with cryptographic signatures that verify the checksum files [1].
[1] https://doc.qubes-os.org/en/latest/project-security/verifying-signatures.html https://doc.qubes-os.org/en/latest/project-security/verifyin...
- xyzzy123 1y agoBut aren't you still trusting the website for instructions about how to verify the cryptographic signatures?
- KAMSPioneer 1y agoThe idea (outlined in the QubesOS documentation) is to clone the git repo of their website, verify the PGP commit signatures, then render the website yourself. Then you can be reasonably sure the website is legitimate, modulo a DoS attack stopping you from receiving updates to the website code, I suppose. Getting the correct PGP public key appears to be an exercise left to the reader, but if you are already running e.g. Fedora, you can view the packaged QubesOS distro keys distributed by your current OS, cross-reference that with a second source such as a PGP keyserver, and unless you're being Mossaded upon you're probably good if they match.
- zahlman 1y agoIt's a standard procedure that could be learned in many other ways.