Opened 7 weeks ago

Last modified 3 days ago

#31905 new enhancement

Sign dmg images (not just their contents)

Reported by: gk Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: tbb-security, tbb-sign
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

Since macOS 10.11.5 there is the option to sign the dmg images themselves (not just their contents) to make sure the .dmg file is actually coming from us. Might be worth doing given that the OpenPGP part requires yet another non-native tool for verification while users could use the built-in macOS capabilities to check whether the .dmg is good.

Apart from that I am not sure about the benefit of signing the .dmg itself. Thanks to juno_hacker at HackerOne for pointing out the missing container signature.

Child Tickets

Change History (1)

comment:1 Changed 3 days ago by gk

Keywords: tbb-sign added; tbb-rbm removed
Note: See TracTickets for help on using tickets.