Re: Proposal to augment CD/faq/#verify, version 2

On 10/09/2024 01:22, Thomas Schmitt wrote:
> i wrote:
>>> $ gpg --keyserver keyring.debian.org --recv-keys 64E6EA7D 6294BE9B 09EA8AC3
> 
> Max Nikulin wrote:
>> Despite I do not expect keys having collisions for 32 bit identifiers
>> uploaded to keyring.debian.org, I think, it is better to use 64 bit
>> identifiers here
[...]
> This is not an additional security problem in the proposed instructions
> because they prescribe to compare the fingerprint, not the subset of the
> fingerprint which is the key id.

I am not trying to say that it is insecure in *this specific case*. 
However from my point of view, it is better to follow general 
recommendations and to avoid a command that might be more risky in the 
case of other key server and other short keys. I do not like the idea of 
showing users bad examples. Anyway this command is intended for 
copy-paste. I do not insist, it is just my opinion.

>> I am unsure if there are drawback of the following recipe. Debian users may
>> try:
>> sudo apt install debian-keyring
> 
> Wouldn't that import all keys ?

It does not import keys, it is necessary to specify a keyring from this 
package explicitly.

> If so, then if the short ids impose any problem, downloading all keys
> would be even more of a problem.

The idea is that content of this keyring may be trusted to the same 
degree as other installed packages. In addition, gpgv does not touch 
user's keyring and it may or may not be an advantage.

>> Nowadays SUMS files may be obtained using https: protocol from
>> cdimage.debian.org even if image file is downloaded from a local mirror. It
>> is secure enough.
> 
> It is not. Most obviously because if you do not trust the download of
> the ISO image, then you cannot trust the SUMS files from the same
> directory and via the same internet connection.

No, I was trying to describe a case opposite to "the same directory". I 
can download .iso using BitTorrent or from a local mirror that is not 
listed on the Debian site. However SUSM files are small and can be 
instantly fetched namely from cdimage.debian.org as the primary source.

On 09/09/2024 17:45, Thomas Schmitt wrote:
> (Note that i know sha512sum option --ignore-missing. But old Debian
> systems like Jessie do not know it.)

To keep FAQ concise, I would consider using --ignore-missing despite 
Jessie has not reached extended LTS EOL yet. More complicated and more 
portable way is perfectly suitable for the wiki article.

Perhaps
     grep "^$computed " SHA512SUMS
is a way to avoid final "test" command.

My idea with isosize without -x and "head -c BYTES" posted to 
debian-user was another attempt to simplify the recipe by avoiding 
separate bs= and count= dd arguments.