Creating a trusted sha256sum.exe binary for verifying *-CHECKSUM files on Windows

[Jesse Keating]

On Tue, 2009-11-24 at 10:33 -0500, Todd Zullinger wrote:
> Some of you might be aware that the instructions for verifying our
> *-CHECKSUM files on Windows have been broken since we moved to SHA256.
> Previously, we linked users to a sha1sum.exe built by the GnuPG
> project.  With SHA256, we don't have that ability.
> 
> Fortunately, the good folks working on MingW have made it possible for
> us to build a sha256sum.exe from the coreutils sources.  We can do
> this in koji even.  (A huge thanks to Richard Jones for his help and
> patches.)
> 
> Much of this is discussed at https://bugzilla.redhat.com/527060.
> 
> I've created a simple mingw32-sha256sum package, built it in koji and
> tested it on the lone Windows XP system I have readily available.  Of
> course, I just built this as a scratch build, so it will expire at
> some point.
> 
> What I'm here for is to gather ideas for how to properly go about
> building the mingw32-sha256sum and keeping it around so that when I
> extract the sha256sum.exe and upload it to fedoraproject.org we will
> have the koji built rpm to compare the binary against.  Otherwise, the
> whole process falls back to "Trust that Todd didn't trojan the
> executable."  And while I'd be flattered if folks had that much trust
> in me, I think it would be unwise to encourage or expect. :)
> 
> (I really don't want to maintain the mingw32-sha256sum package for
> Fedora, as it's just a quick and dirty hack to built a small subset of
> of coreutils for Windows.)
> 
> Thoughts?

Well, if you have to use a tool from the project, to verify other bits
from the project, the verification just became a lot less trusted.  If
you don't trust the bits you got from the project, why would you trust
the tool the project gives you to verify the bits?  "Here use this tool
to verify our bits.  Trust us, we swear!"

-- 
Jesse Keating
Fedora -- Freedom² is a feature!
identi.ca: http://identi.ca/jkeating
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <http://listman.redhat.com/archives/fedora-infrastructure-list/attachments/20091124/f75f8f92/attachment.sig>