5

Downloading

  • sha256sums.txt
  • downloading one or more signatures
  • the archive itself

Then verifying each signature one by one. Then creating the sha256 of the archive. Then looking into the sha256sums.txt file if the sha256 sum matches. These are a lot steps. Kinda more cumbersome than verifying TBB 2.x (where you just verify the archive with a signature).

Can the required steps be reduced a bit without sacrificing security? Is shasums --check helpful?

If you want, feel free to edit this question and make it Linux/CLI specific if its too broad.

1

This could be scripted.

!/bin/sh

d=https://archive.torproject.org/tor-package-archive/torbrowser/3.0a4/
z=TorBrowserBundle-3.0-alpha-4-osx32_de.zip

wget --no-check-certificate $d/$z
wget --no-check-certificate $d/sha256sums.txt
for u in dcf erinn gk ln5 mp
do
    wget --no-check-certificate $d/sha256sums.txt.$u-asc
done 

verified=1
for asc in *-asc
do
    gpg --verify $asc sha256sums.txt
    v=$?
    [[ $v -eq 0 ]] && verified=0
done

if [[ $verified -eq 0 ]]
then
    t=$(mktemp -t sha)
    grep $z sha256sums.txt > $t
    shasum -c $t
    rm $t
else
    echo no signature could be verified
fi

This works on Mac OS X with all the tools installed from MacPorts.

  • 3
    Note that using gpg's exit code is not a reliable indication of whether things are all great or not. Might be better to use --status-fd and look for VALID_SIG. Maybe even with the fingerprints we expect. If you write a /bin/sh script you should probably not use bashisms such as [[. Also, please quote your variables, thanks :) – weasel - Peter Palfrader Nov 2 '13 at 22:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.