Desktop: No checksum or signature files available

[Kusken]

There are currently no checksum or signature file available for verification of file integrity and source.

I can see that the latest release on github has a verified gpg signature, but if I want to download files from the standard notes website then I have no means to verify signature or source.

Please make checksum & signature files available

[mobitar]

The applications are signed on Mac and Windows on the OS level. They won’t run if the downloaded file’s signature doesn’t match. Checksums are also available for every release here: https://github.com/standardnotes/desktop/releases

Open the latest-{platform}.yml file, and see the sha512 value. You can verify this manually using:

openssl dgst -sha512 standard-notes-2.2.5-x86_64.AppImage

The result will be in hex. The published string is base64. So we need to convert hex to base64. We can use node for this:

$ node
> new Buffer(hexResult, 'hex').toString('base64') 

(Be sure not to directly convert hex as a plain string to base64. You want to convert the hex binary data to base64.)

More on how Windows code signing works:
https://docs.microsoft.com/en-us/windows-hardware/drivers/install/authenticode

Mac code signing:
https://developer.apple.com/support/code-signing/

[Kusken]

I understand that it can be done this way.

However I would still suggest making checksum and signature files available on the standardnotes website to make things accessible. You shouldn't need to search through issues and github releases to take trivial security measures.

Feel free to close this issue if you don't think its an issue ;)

//Thanks for your time, and your answers

[mobitar]

Agreed. Hope to spend more time on this in the near future.

[pshelly]

You could sign the linux (and other versions) with gpg.
Example:
https://www.veracrypt.fr/en/Downloads.html

Something like this would be ideal.

[pshelly]

I'd also suggest to make signatures and checksums of the offline program.

[VishalRao]

@pshelly Good suggestions. I really think they should publish the hex sha512 sums in a text file. It's still not 100% secure against man-in-the-middle attacks, but it's a great first level heuristic that's easy to verify.

[pshelly]

If they also sign the hashes like in the veracrypt website, MITM attacks are solved. Paranoid, but it works.

[mobitar]

In the future I plan to have checksums automated as part of release notes. For now, they can be acquired using the steps above.

[leafcutterant]

I don't wish to rely solely on my operating system to verify the authenticity of the SN installers. Thank you for considering PGP-signing releases.