Re: Authenticity enforcement in NetBSD distfiles

Martin Husemann <[email protected]> Sun, 15 Oct 2023 09:49:38 +0200

Newsgroups	gmane.os.netbsd.devel.security
Message-ID	<[email protected]>

On Sat, Oct 14, 2023 at 07:36:20PM -0300, hrcerq wrote:
> Yet, I could find no signature files

On the main page, in the "Get NetBSD" section is a link to

	"A list of signed hashes for the NetBSD 9.3 distribution."

pointing at:

	https://cdn.netbsd.org/pub/NetBSD/security/hashes/NetBSD-9.3_hashes.asc

We currently do not sign all automatic builds, but all formal releases have
the signed hash file.

Martin