newbee85 wrote: Mon Dec 16, 2024 1:39 pm
fehlix wrote: Mon Dec 16, 2024 11:03 am
Also don't forget to verify the downloaded ISO, either with the sha512 checksum file or even better with the provided signature file.
how do you do you do that?
In case you don't have Linux already, you can verify the checksums provided this way on Windows:
Probably easiest with an example:
* Download both the ISO and the checksum file, for official snapshot iso's we use sha512 checksums:
Code: Select all
iso file : MX-23.4_December_x64.iso
sha512sum: MX-23.4_December_x64.iso.sha512
* Open within the download folder where both files have been saved a "Terminal"/"Commandline", suggest to open the PowerShell terminal:
On the PS-prompt:
First way, using build-in tool "certutil" with this command:
Code: Select all
certutil -hashfile .\MX-23.4_December_x64.iso SHA512
which should calculate and display a long checksum like this:
Code: Select all
SHA512-Hash of .\MX-23.4_December_x64.iso:
6e975cdde8bb4fbb96d6dab4050384617ddd9917ea754b6d47fc6d4caef5b2d46edef65d4f9ac6c13f93df3629b7a3a8cf506fd5b2ff7009a6e55e125e586709
alternatively use a powershell function to calculate the hash-sum this way:
Code: Select all
(Get-FileHash .\MX-23.4_December_x64.iso -Algorithm SHA512).hash
6E975CDDE8BB4FBB96D6DAB4050384617DDD9917EA754B6D47FC6D4CAEF5B2D46EDEF65D4F9AC6C13F93DF3629B7A3A8CF506FD5B2FF7009A6E55E125E586709
Now display the content of the downloaded .sha512 file with "type" command:
Code: Select all
type MX-23.4_December_x64.iso.sha512
6e975cdde8bb4fbb96d6dab4050384617ddd9917ea754b6d47fc6d4caef5b2d46edef65d4f9ac6c13f93df3629b7a3a8cf506fd5b2ff7009a6e55e125e586709 MX-23.4_December_x64.iso
You can now manually /visually compare this long string, which should be identical.
Alternatively instead of trying to compare those long checksum strings, let PowerShell do this with:
Code: Select all
(Get-FileHash .\MX-23.4_December_x64.iso -Algorithm SHA512).hash -eq "6e975cdde8bb4fbb96d6dab4050384617ddd9917ea754b6d47fc6d4caef5b2d46edef65d4f9ac6c13f93df3629b7a3a8cf506fd5b2ff7009a6e55e125e586709"
True
Both checksum - the calculated and the provided would match and you get "True".
You copy/paste from the output of the "type" command (Click the checksum to select, Enter to copy, and Right-click to paste.)
In addition to the checksum verification, there are also pgp/gpg/GnuPG-signature files provide to download.
To perform a gpg-sIgnature verification of the iso-file on WIndows some tools would need to be installed as Windows does not
provide a build-in tool do do this. E.g use Gpg4win
https://www.gpg4win.org/
On Linux
To perform checksum verification run the tools sha512sum like this:
Code: Select all
sha512sum --check MX-23.4_December_x64.iso.sha512
MX-23.4_December_x64.iso: OK
A signature verification on MX Linux, where we have gpgv verifier tool installed looks like this:
using this way:
gpgv sig-file followed by iso-file
Code: Select all
gpgv MX-23.4_December_x64.iso.sig MX-23.4_December_x64.iso
and would display this
Code: Select all
gpgv: Signature made Sun Dec 15 17:38:41 2024 EST
gpgv: using RSA key F27753A18E92E3937E6335E770938C780679EE98
gpgv: Good signature from "Adrian <adrian@mxlinux.org>"
but only if the file would match to the signature provided.
Also the above signature shows that the "signer" is really the one we know and who has generated the snapshot.
You would first get the signers public-signature key imported into the gpg keyring.
More about this gpg-signaure file verification for MX Linux and how to import the public signing key
here at the MX Linux Wiki
https://mxlinux.org/wiki/system/signed-iso-files/
HTH