Hacker News new | ask | show | jobs
by rbrownsuse 3629 days ago
Incredibly, there does not appear to be any way whatsoever to securely verify downloads from respected openSUSE.

Seriously? the author has no idea what they're talking about

http://software.opensuse.org

"For each ISO, we offer a checksum file with the corresponding SHA256 sum. For extra security, you can use GPG to verify who signed those .sha256 files. It should be 22C0 7BA5 3417 8CD0 2EFE 22AA B88B 2FD4 3DBD C284."

https://en.opensuse.org/openSUSE:Tumbleweed_installation

http://download.opensuse.org/tumbleweed/iso/openSUSE-Tumblew...

http://download.opensuse.org/tumbleweed/iso/openSUSE-Tumblew...

http://download.opensuse.org/distribution/leap/42.1/iso/open...

http://download.opensuse.org/distribution/leap/42.1/iso/open...

All signed, happy and healthy...and regularly checked.. people really should double check before making statements like this..

1 comments

All signed, with the signature keys delivered over HTTP, just as the site states.
https://software.opensuse.org/ offers the GPG fingerprint over HTTPS. A bit curious that they don't enforce HTTPS for this page, but it is there.

And the key has been the same for years, so there are quite a few independent sources quoting it, which helps to verify it.

the site states that openSUSE does not sign it's checksums or provide instructions on how to verify them

Both claims are demonstrably false.