DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:mime-version:from:date:message-id:subject:to
	:content-type; q=dns; s=default; b=xmpuhXZYllfWezMQ7Sw62jJqzS+sA
	pLyLgkAclH87m76y8fj/O7AQ2niBgw3eNl69W8xMVujL7FXUlxJiabqgs5R9CThm
	dCxqN1TZ+GJ01uaCQb/j2vWm/oo1EKxCzg1RDFXh+nNcS9AZoBNzW+bjz5apMsxK
	Cq0fIhLiC5Ykng=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
MIME-Version: 1.0
From: Joel Rees <joel.rees@gmail.com>
Date: Sat, 27 Apr 2019 01:28:14 +0900
Message-ID: <CAAr43iMirXR-r=Jmy1S0za8Pz-yS-beOGouydkrScHKETEmiZg@mail.gmail.com>
Subject: How to trust setup.exe?
To: cygwin@cygwin.com
Content-Type: text/plain; charset="UTF-8"

When bootstrapping a chain of trust, having multiple sources for the
checksum values is significantly better than starting blind.

I'm writing a blogpost on the use of multiple sources, using cygwin as
an example, but the announcements for the updates of setup_xx.exe do
not include the checksums. And the mirrors don't seem to keep
setup_xx.exe. And the mirrors are all using .bz and .xz compression,
which many MSWindowsboxes are not able to open without 3rd party help,
which is a vicious cycle.

The blogpost:
https://joels-programming-fun.blogspot.com/2019/04/bootstrapping-your-freedom-cygwin-gpg.html

Would it be impossible to ask someone in the project to put the
checksums in the announcements for setup?

And what about putting a regular zip compressed setup on the mirrors,
so we can run certutil to check the checksum of the setup we run when
we grab our first download, then grab gpg with a somewhat trusted
system to use when checking the next version of setup that we
download?

It would not be a perfect chain, but without that we have nothing but
broken links and reverse implications

-- 
Joel Rees

http://reiisi.blogspot.jp/p/novels-i-am-writing.html

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple