4

Downloading

  • sha256sums.txt
  • downloading one or more signatures
  • the archive itself

Then verifying each signature one by one. Then creating the sha256 of the archive. Then looking into the sha256sums.txt file if the sha256 sum matches. These are a lot steps. Kinda more cumbersome than verifying TBB 2.x (where you just verify the archive with a signature).

Can the required steps be reduced a bit without sacrificing security? Is shasums --check helpful?

If you want, feel free to edit this question and make it Linux/CLI specific if its too broad.

Improve this question
2

1 Answer 1

Reset to default
1

This could be scripted.

!/bin/sh

d=https://archive.torproject.org/tor-package-archive/torbrowser/3.0a4/
z=TorBrowserBundle-3.0-alpha-4-osx32_de.zip

wget --no-check-certificate $d/$z
wget --no-check-certificate $d/sha256sums.txt
for u in dcf erinn gk ln5 mp
do
    wget --no-check-certificate $d/sha256sums.txt.$u-asc
done 

verified=1
for asc in *-asc
do
    gpg --verify $asc sha256sums.txt
    v=$?
    [[ $v -eq 0 ]] && verified=0
done

if [[ $verified -eq 0 ]]
then
    t=$(mktemp -t sha)
    grep $z sha256sums.txt > $t
    shasum -c $t
    rm $t
else
    echo no signature could be verified
fi

This works on Mac OS X with all the tools installed from MacPorts.

Improve this answer
1
  • 3
    Note that using gpg's exit code is not a reliable indication of whether things are all great or not. Might be better to use --status-fd and look for VALID_SIG. Maybe even with the fingerprints we expect. If you write a /bin/sh script you should probably not use bashisms such as [[. Also, please quote your variables, thanks :)
    – weasel - Peter Palfrader
    Commented Nov 2, 2013 at 22:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .