When bootstrapping a chain of trust, having multiple sources for the checksum values is significantly better than starting blind.
I'm writing a blogpost on the use of multiple sources, using cygwin as an example, but the announcements for the updates of setup_xx.exe do not include the checksums. And the mirrors don't seem to keep setup_xx.exe. And the mirrors are all using .bz and .xz compression, which many MSWindowsboxes are not able to open without 3rd party help, which is a vicious cycle. The blogpost: https://joels-programming-fun.blogspot.com/2019/04/bootstrapping-your-freedom-cygwin-gpg.html Would it be impossible to ask someone in the project to put the checksums in the announcements for setup? And what about putting a regular zip compressed setup on the mirrors, so we can run certutil to check the checksum of the setup we run when we grab our first download, then grab gpg with a somewhat trusted system to use when checking the next version of setup that we download? It would not be a perfect chain, but without that we have nothing but broken links and reverse implications -- Joel Rees http://reiisi.blogspot.jp/p/novels-i-am-writing.html -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
