Apple releases OS X Mavericks 10.9.2 with SSL fix

Re:Apple releases OS X Mavericks 10.9.2 with SSL fix by eik3_de on Tuesday February 25, 2014 @01:38PM (#7299478)

Is it possible to manually verify the code signature with Apple's built-in public key before installing?

[ Parent | on HN ]

Re:Apple releases OS X Mavericks 10.9.2 with SSL fix by lotharrr on Tuesday February 25, 2014 @02:09PM (#7299711)

I would hope the built-in software-upgrade process does exactly that (independent of transport-layer SSL), but I have no evidence either way.

The manual-download pages on http://support.apple.com/downloads/ publish SHA1 sums. Unfortunately those pages aren't served over SSL. You could download the update and compare its hash against those of your friends: at least then you'd all be installing the same thing (preventing narrowly-targetted attacks).

[ Parent | on HN ]

Re:Apple releases OS X Mavericks 10.9.2 with SSL fix by sitkack on Tuesday February 25, 2014 @02:31PM (#7299857)

The Apple site http://support.apple.com/kb/DL1726 reports

  c06a63982b522e43997a05cedc04b0bdb1a10207

which matches my download using `shasum -a OSXUpdCombo10.9.2.dmg`

[ Parent | on HN ]

Re:Apple releases OS X Mavericks 10.9.2 with SSL fix by IPGlider on Tuesday February 25, 2014 @02:11PM (#7299720)

  pkgutil --check-signature OSXUpd10.9.2.dmg

[ Parent | on HN ]