freebsd security - Jan 2016 - Signed Checksums for release archives

The signed checksums linked on that page only include checksums for the
.img and .iso images. Not for the .txz archives.

On Sun, Jan 10, 2016 at 9:17 AM Dmitry Morozovsky <marck at rinet.ru>
wrote:
> On Sun, 10 Jan 2016, Clint Armstrong wrote:
>
> > The signed checksums at
> > https://www.freebsd.org/releases/10.2R/signatures.html provide a way
to
> > verify installation sources, but there do not appear to be any signed
> > checksums for the release archives at
> > ftp://ftp.freebsd.org/pub/FreeBSD/releases/amd64/amd64/10.2-RELEASE/.
Is
> > there another source of signed checksums hosted elsewhere or any other
> way
> > to verify archive downloads?
>
> On the release page: https://www.freebsd.org/releases/10.2R/
>
>
> --
> Sincerely,
> D.Marck                                     [DM5020, MCK-RIPE, DM3-RIPN]
> [ FreeBSD committer:                                 marck at FreeBSD.org ]
> ------------------------------------------------------------------------
> *** Dmitry Morozovsky --- D.Marck --- Wild Woozle --- marck at rinet.ru ***
> ------------------------------------------------------------------------
>

On Sun, 10 Jan 2016, Clint Armstrong wrote:
> The signed checksums linked on that page only include checksums for the
> .img and .iso images. Not for the .txz archives.
Ah I see.  But nevertheless, these .txz's are almost always accessed from
the
installer, which selects only approved mirror from well-defined list, and 
connects to them over TLS...


-- 
Sincerely,
D.Marck                                     [DM5020, MCK-RIPE, DM3-RIPN]
[ FreeBSD committer:                                 marck at FreeBSD.org ]
------------------------------------------------------------------------
*** Dmitry Morozovsky --- D.Marck --- Wild Woozle --- marck at rinet.ru ***
------------------------------------------------------------------------