Lesson 5.41: Verifying upstream releases with GnuPG
Most open-source projects publish a checksum list (SHA256SUMS) and sign that list with their release key. A matching checksum proves the download wasn't corrupted; only the signature proves the list came from the project. In the lab you download two releases of a command-line tool, one from the project and one from a fast mirror. You check the key's fingerprint against the project's website, import it, verify the signed list, check the archives, and catch the mirror's modified release and its rewritten checksum list.
16 min
You will learn to
- Explain checksum vs signature
- Check a key's fingerprint before importing it
- Verify a detached signature with gpg --verify
- Check files with sha256sum -c
- Recognise a tampered mirror
Key terms
- Checksum list
- SHA256SUMS: one 'hash filename' line per release file.
- Detached signature
- A separate file (.asc, .sig) with an OpenPGP signature over another file.
- Fingerprint
- The hash that identifies a key; compare it over a trusted channel.
- Good / BAD signature
- Good: this key signed exactly this content. BAD: the content changed after signing.
- --ignore-missing
- sha256sum -c option: skip listed files that aren't present.
← Capstone 2: proving the rebuilt server is better · All lessons · Packet analysis: finding what a device is really doing →