EDIT: I have made some progress, but to avoid double-posting, I am adding it here. See my original post below, and then the update. Thanks for your time!
Original Post
This text will be hidden
Hey, everyone. Been doing a lot of reading, but new to GPG and struggling to figure out how to verify the PureOS iso I downloaded. Would appreciate any help on what to fix in my process. Here’s what I’ve done so far:
Checked that the iso I downloaded matches the sha256 sum given on the download page.
I’m probably just missing something obvious here. Would really appreciate anyone’s time in helping me out/directing me to other resources.
Update: it seems that what I have is the PureOS keyring, but nothing to verify it with. I eventually found the https://downloads.puri.sm/ URL, which, under snapshots, gives me an actual file with the sha256 sums (as opposed to them being displayed on the other downloads page). I thought I might be able to use the keyring to verify this file, but again, I get an error.
I’m starting to second-guess myself, but I am correct to think that I should be able to verify with GPG the checksums I used to verify the iso, right?
Thanks for your reply, vrata. I do see the checksum below the download button, but I can’t find its accompanying signature (step 2 on the tutorial you linked), which seems to be the problem.
Perhaps this is a case, like the tutorial mentioned, in which there is none. I assumed it was more likely there was one that I couldn’t find, given that they have the keyring available on the github page.
A checksum is a hash value of a file, in this case the released iso file.
A signature means a cryptographic signature according to some cryptographic signature algorithm (commonly using th ersa cryptosystem see for instance https://en.wikipedia.org/wiki/RSA_(cryptosystem)#Signing_messages).
What SR388 was asking about was IMHO a cryptographic signature using Purisms key (e.g. one key in the keyring) of the sha256 hashs found on the download page. As far as I know such a signature does not exist, it is thus essentially impossible to verify the integrity of the downloaded iso file (see also my comment at Security concerns with PureOs repos (and website)), the hashs only serve as a means to detect a non-maliciously corrupted download.
Yes, this is what I was asking about. When I learned about verifying ISOs and checksums (remember, I’m just a hobbyist), I read that checksums by themselves only tell you about the integrity of your download (that it wasn’t intercepted). If a hacker is able to swap out the ISO with a tampered one, it is a trivial step to change the listed checksums as well. To combat this, PureOS should have a cryptographic signature hosted on an external website that verifies a .txt file containing the checksum (so that the attack would need to encompass two websites).
Glad to see this is being discussed on the other thread, @kV1x_2xx. Hopefully a signature system is implemented. Thank you @vrata for putting together this nice guide on verifying the checksums.
Glad to see this is being discussed on the other thread, @kV1x_2xx. Hopefully a signature system is implemented. Thank you @vrata for putting together this nice guide on verifying the checksums.
Yes, there is also a issue I opened in PureOS tracker about missing signature of ISO file/checksums of it. https://tracker.pureos.net/T116