DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:reply-to:subject:references:to:from:message-id
	:date:mime-version:in-reply-to:content-type
	:content-transfer-encoding; q=dns; s=default; b=LYPjbDXyCHYuNI+a
	UXgIGQtpEyn8mzrGn8dASvW+oX5j9h0ClCUFv8Mptau61PpuWoDmvVnvl/ISWUoH
	cJl2F/Xl2aRt/8HY98cKRlc5tkY5MquXIU8B+kPGSZ/KdeMS36odSOJJj60WFpXv
	SzV8s2FHtkxIfV0wIth/Z7bcYAk=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
Reply-To: cygwin@cygwin.com
Subject: Re: Cygwin's installation and security models?
References: <1740128398.25713364.1471398599819.JavaMail.yahoo.ref@mail.yahoo.com> <1740128398.25713364.1471398599819.JavaMail.yahoo@mail.yahoo.com>
To: cygwin@cygwin.com
From: Brian Inglis <Brian.Inglis@SystematicSw.ab.ca>
Message-ID: <db827cf0-8b99-408a-dea9-7ee9d4bcddc7@SystematicSw.ab.ca>
Date: Tue, 16 Aug 2016 22:17:51 -0600
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0
MIME-Version: 1.0
In-Reply-To: <1740128398.25713364.1471398599819.JavaMail.yahoo@mail.yahoo.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit

On 2016-08-16 19:49, lloyd.wood@yahoo.co.uk wrote:
> I'd like to understand Cygwin's installation and
> security models better:
> - Cygwin's installers aren't signed.
> - downloads are from a number of untrusted mirrors
>   via http/ftp, and packages aren't verified.
> Is this correct?

Nope!
The installer is downloaded from a TLS enabled web site.
The installer manifest contains a public key, so the build
or at least the manifest is signed with a private key.
There are detached GPG signatures for the installer programs
setup_x86{,_64}.exe and setup.ini data files, verified by the
installer.
The setup.ini installer data files contain message digests
for each of the installable packages, verified by the
installer.
HTH
-- 
Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple