GPG Signed binaries? about desktop-app HOT 4 CLOSED

Thanks, @jonathancross for the useful enhancement suggestion. We are going to implement it.

from desktop-app.

Hi @jonathancross
we have implemented the possibility to verify binaries. It works for versions starting from v3.0.0.

Next steps should be performed, to verify the signature (we did not update this info on the website yet):

1. Download ‘installer' and it's signature.
   The signature file has the same name as binary with the .sign.sha256.base64 at the end.
   macOS (example):
   https://repo.ivpn.net/macos/bin/IVPN-3.3.20.dmg and https://repo.ivpn.net/macos/bin/IVPN-3.3.20.dmg.sign.sha256.base64
   Windows (example):
   https://repo.ivpn.net/windows/bin/IVPN-Client-v3.3.20.exe and https://repo.ivpn.net/windows/bin/IVPN-Client-v3.3.20.exe.sign.sha256.base64

2. Download OpenSSL public key for verification
   macOS: https://repo.ivpn.net/macos/keys/public.pem
   Windows: https://repo.ivpn.net/windows/keys/public.pem

3. Verification commands
   macOS (example):

    # Decode base64:
    $ openssl base64 -d -in IVPN-3.3.20.dmg.sign.sha256.base64 -out IVPN-3.3.20.dmg.sign.sha256
    # Check signature:
    $ openssl dgst -sha256 -verify public.pem -signature IVPN-3.3.20.dmg.sign.sha256 IVPN-3.3.20.dmg

Windows (example):

    # Decode base64:
    $ openssl base64 -d -in IVPN-Client-v3.3.20.exe.sign.sha256.base64 -out IVPN-Client-v3.3.20.exe.sign.sha256
    # Check signature:
    $ openssl dgst -sha256 -verify public.pem -signature IVPN-Client-v3.3.20.exe.sign.sha256 IVPN-Client-v3.3.20.exe

from desktop-app.

Hi @stenya I appreciate you making some effort here, but this is not the same as a GPG signature.
With GPG/PGP we have a "web of trust" -- a way to establish trust (out of band) that the key used to sign is authentic.
For example, your "IVPN Administrator <[email protected]>" key (0xC485B578) has signatures from several others making it easier to verify the correct key if any of those people are known or they are in the wider Web Of Trust.

With your suggested replacement, we are left to trust whatever certificate is returned at the above URL.

from desktop-app.

Another request for key verefication.

Example: https://docs.wasabiwallet.io/using-wasabi/InstallPackage.html#debian-and-ubuntu

from desktop-app.