3 ms·
Is it possible to manually verify the code signature with Apple's built-in public key before installing?
by eik3_de 13y ago
Is it possible to manually verify the code signature with Apple's built-in public key before installing?
- deleted 13y ago[deleted]
- lotharrr 13y agoI would hope the built-in software-upgrade process does exactly that (independent of transport-layer SSL), but I have no evidence either way. The manual-download pages on http://support.apple.com/downloads/ http://support.apple.com/downloads/ publish SHA1 sums. Unfortunately those pages aren't served over SSL. You could download the update and compare its hash against those of your friends: at least then you'd all be installing the same thing (preventing narrowly-targetted attacks).
- sitkack 13y agoThe Apple site http://support.apple.com/kb/DL1726 http://support.apple.com/kb/DL1726 reports c06a63982b522e43997a05cedc04b0bdb1a10207 which matches my download using `shasum -a OSXUpdCombo10.9.2.dmg`
- IPGlider 13y agopkgutil --check-signature OSXUpd10.9.2.dmg