Documentation for cryptographic authenticity & integrity verification of installers using gpg (and link to it on download page)
Categories
(Toolkit :: Downloads API, enhancement)
Tracking
()
People
(Reporter: bugzilla_mozilla, Unassigned)
Details
User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0
Steps to reproduce:
Download Firefox from here https://www.mozilla.org/en-US/firefox/all/#product-desktop-release
?????
Install Firefox
Actual results:
I couldn't find any mention on the download page about how I can actually verify the authenticity and integrity of my download cryptographically.
I searched the 'net and the wiki, I couldn't find any such guide.
The best I could find was this blog post from Mozila in June 2019 that was a PSA for a change to "The GPG key used to sign the Firefox release manifests"
...but I still couldn't find any link to any of these manifests nor their signatures.
Expected results:
Somewhere on the page where I click "download" to download firefox, some link with the keywords "gpg" or "pgp" or "verify" or "integrity" or "digest" or "checksum" should appear with a link to some documentation page that tells the user how to cryptographically verify the integrity of the firefox installer after download.
For example, consider similar projects:
- https://keepassxc.org/verifying-signatures/
- https://www.qubes-os.org/security/verifying-signatures/
- https://ubuntu.com/tutorials/how-to-verify-ubuntu#1-overview
- https://wiki.archlinux.org/index.php/Installation_guide#Verify_signature
- https://www.gentoo.org/downloads/signatures/
- https://docs.buskill.in/buskill-app/en/stable/software_usr/signature.html
Note: Because of the various issues with the X.509 PKI model in general, there are fundamental flaws with the Windows Authenticode signature system, and Windows users should also be provided with documentation for how to properly verify their downloads. There is an article on the mozilla wiki that goes into some detail on this:
Fortunately, Mozilla already signs their cryptographically-secure SHA256SUMS and SHA512SUMS manifests, so the only thing missing here is to document it and link to that documentation on the download page. For more info, see:
|
||
Comment 1•5 years ago
|
||
Bugbug thinks this bug should belong to this component, but please revert this change in case of error.
|
Reporter | |
Comment 2•5 years ago
|
||
Forgot to include a link to the mozilla blog post in June 2019:
|
||
Comment 3•5 years ago
|
||
The PGP key from that blog post, and the current release directories, no longer verify current nightly builds as of yesterday (bug 1713258).
Description
•