When downloading EOS ISOs (or files in general) there’s the strongly encouraged security step of comparing the checksum to a separately-provide shasum file or similar security key.
I’ve long been curious …
Other than just confirming your hefty download didn’t miss a byte somewhere and get (accidentally) corrupted along the way, how does confirming a checksum actually enhance security?
Specifically: If someone can maliciously exchange the ISO for another file with some nefarious payload, couldn’t they just as easily exchange the original checksum file for one that perfectly matches their own uploaded package, instead?
Best practice ofcource to recieve checksum throught different channel. Like torrent for example.
Also usually checksums got put in different places by different means.
Just as example, attack that replaces files you downloading not necessery replases text on web page.
Some attacks can modify iso on fly but unable to calculate and replace checksum and even do not know where to do so.
But, I feel, it is not so important from infividual perespective to verify checksum. It is important by creating how to call it (field of trust) that makes easy attacts - difficult.
It’s a fair point @ArchieLinux, and the simple answer is, yes, that’s entirely possible.
As you noted, the checksum can perform two functions:
Confirming the file is an exact byte-for-byte digital copy of the hosted file.
Confirming the file is authentic.
A mirror operator for example, could go off-the-rails, upload an ISO that has been nefariously tampered with, as well as uploading a checksum derived from that modified ISO. If the only source of truth the user is relying on, is that mirror operator, then they have only satisfied one of the two checksum functions:
✓Confirming the file is an exact byte-for-byte digital copy of the hosted file.
✗ Confirming the file is authentic.
To verify what you’re downloading is legitimate, you should confirm via the original source, ie: the checksum published on the primary EndeavourOS mirror (Alpix if I’m not mistaken), or the EndeavourOS website.
Makes sense. But if getting the checksum on the primary mirror, then why not get the ISO from the primary mirror, too? Seems impractical to hunt for two sources, one trusted and one less so.
And I guess checksums on GitHub don’t really provide an opportunity for dual sourcing like this.
