Distroverify 1.0 released, the ultimate tool to verify ISO's

Posted by emilengler on Tuesday February 26, 2019 @01:08PM
from the github.com dept.

https://github.com/emilengler/distroverify

( 2 comments | 10 points | on HN )

Re:Distroverify 1.0 released, the ultimate tool to verify ISO's by rlpb on Tuesday February 26, 2019 @06:14PM (#19259323)

I'm not sure this is safe to use. If https://raw.githubusercontent.com/emilengler/distroverify-da... is compromised (for example your GitHub account is compromised) then it looks to me that line 51 of https://github.com/emilengler/distroverify/blob/master/distr... (in commit b55c30c) will give the attacker arbitrary code execution on anyone using this tool.

[ Parent | on HN ]

Re:Distroverify 1.0 released, the ultimate tool to verify ISO's by rgovostes on Tuesday February 26, 2019 @04:43PM (#19258555)

I think your idea to make it easier for people to verify their OS install media is a good one.

One thing to think about is that the keys and key servers come from your own repo. How are people going to be sure that your repo contains the right values?

[ Parent | on HN ]