Relatively Linux Newbie here. Been playing with flavors of Linux/Unix/BSD for a few decades but only recently moved to having one as my primary OS.

My question is: Since I don’t think of myself as a person of interest, is there a solid reason to do things like validate hashes or signatures when I get packages from a non-standard repo?

For example, I want to do something with a tool that doesn’t have it’s own repository. They have a website with a .deb or .tar.gz download and an accompanying signature file or hash. There are instructions for grabbing the public key from their domain so I can verify the file or there is a hash text string.

I can go verify a hash or signature… but if I got the file and the signature from the same place . . . If an attacker wanted to hand me bad code, couldn’t they also hand me a bad signature/certificate/key?

If I was given a flash drive with a tool by a random person, then I might want to validate it, but if I download a file from an org that I went to on purpose then the org giving me their key doesn’t seem to do much. Aside from file corruption, there’s nothing to prove and a corrupted file is likely to fail in other ways such as a .gz checksum.

I’m not saying the practice is bad. But if I’m not important enough to have someone waiting to intercept my random app download and give me a backdoored version and I trust the developer to not be giving me malware in the first place, is there a need to verify?

  • cosmicrose@lemmy.blahaj.zoneEnglish
    2·
    16 days ago

    The key concepts here are “validity” versus “trust.” You can use gnupg to mark a key as “trusted,” and when you validate a signature, PGP checks to see if if the signing key is trusted. So hypothetically you’d download the key, mark it as trusted on your machine, and then next time you download the software, you can verify the signature, and PGP says the signature is valid and trusted. Here’s a post from the Linux foundation about trust: PGP Web of Trust: Core Concepts Behind Trusted Communication.

    You’re right that if you download something at the same time you download the signature, it’s possible that both were tampered with. This is where key signatures come into play. In PGP, key signing is very important because it forms a web of trust, where keys are signed by other keys, which is like a public declaration that the signing key trusts the signed key. Then, when you verify a signature, PGP tries to find a chain of signatures, starting from a key you’ve directly marked as trusted, to the key that made the signature you’re verifying. Here’s part 2 of the Linux Foundation’s series on PGP trust that follows that first post: PGP Web of Trust: Delegated Trust and Keyservers.

    This is entirely separate from just verifying a hash. If you get like an MD5 or SHA256 hash of a file, that is purely for checking that the file didn’t get corrupted by a bad download, etc.

    • korazail@eviltoast.orgOPEnglish
      2·
      15 days ago

      Thanks! The Web of Trust is a concept I’ve heard of, but never really understood/realized. Your links were informative. I had several questions that were answered when I read them.