Re: How to trust setup.exe?
- Date: Sat, 27 Apr 2019 11:42:37 +0200
- From: Achim Gratz <Stromeko@xxxxxxxx>
- Subject: Re: How to trust setup.exe?
Am 26.04.2019 um 18:28 schrieb Joel Rees:
When bootstrapping a chain of trust, having multiple sources for the
checksum values is significantly better than starting blind.
Except that checksums are at best providing evidence of tampering, not
anchors of trust.
I'm writing a blogpost on the use of multiple sources, using cygwin as
an example, but the announcements for the updates of setup_xx.exe do
not include the checksums.
The root of trust for setup.exe and the whole of the Cygwin installation
is the GPG key for cygwin@xxxxxxxxxx and the integrity of the
sourceware.org server hosting the original files, not the checksum of
any of the files. Those checksum files you are talking about are
largely an artefact of how the sourceware.org servers are set up and are
not meant to provide the assurances you seek.
And the mirrors don't seem to keep
setup_xx.exe. And the mirrors are all using .bz and .xz compression,
which many MSWindowsboxes are not able to open without 3rd party help,
which is a vicious cycle.
The mirrors are, as the name implies, mirrors, so any compression used
is already there in the (non-public) repo the mirrors are distributing.
The setup.ini file is also available uncompressed, though, expressedly
so folks can read it without having to decompress anything.
That would need significant reorganization to become useful, IMHO. But
again, you're missing the whole point of what the trust anchor really is
and how to verify it. And yes, that bootstrapping step (obtaining and
vetting setup.exe) would have to be done on a different system than the
one you intend to install on if you are serious about it; although if
you suspect that someone manipulates your system, then installing a
clean Cygwin (assuming you succeed at it) onto that isn't really going
to help matters.
Would it be impossible to ask someone in the project to put the
checksums in the announcements for setup?
Are you asking about the possibility of asking?
I'm not involved in releasing new setup.exe versions onto the server, so
I can't comment on how much extra work it'd be to add the checksums to
And what about putting a regular zip compressed setup on the mirrors,
so we can run certutil to check the checksum of the setup we run when
we grab our first download, then grab gpg with a somewhat trusted
system to use when checking the next version of setup that we
The way things work right now the mirrors don't need to be trusted with
anything. Distributing setup.exe over the mirrors would actually open a
door to manipulation if a user can be tricked or forced into using only
(one or a clique of) rogue mirror(s).
It would not be a perfect chain, but without that we have nothing but
broken links and reverse implications
Perfection is not attainable anyway.
(on the road :-)
Problem reports: http://cygwin.com/problems.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple