Opened 11 months ago

Last modified 9 months ago

#31905 new enhancement

Sign dmg images (not just their contents)

Reported by: gk Owned by: tbb-team
Priority: Medium Milestone:
Component: Applications/Tor Browser Version:
Severity: Normal Keywords: tbb-security, tbb-sign, TorBrowserTeamTriaged
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:


Since macOS 10.11.5 there is the option to sign the dmg images themselves (not just their contents) to make sure the .dmg file is actually coming from us. Might be worth doing given that the OpenPGP part requires yet another non-native tool for verification while users could use the built-in macOS capabilities to check whether the .dmg is good.

Apart from that I am not sure about the benefit of signing the .dmg itself. Thanks to juno_hacker at HackerOne for pointing out the missing container signature.

Child Tickets

Change History (2)

comment:1 Changed 9 months ago by gk

Keywords: tbb-sign added; tbb-rbm removed

comment:2 Changed 9 months ago by sysrqb

Keywords: TorBrowserTeamTriaged added
Note: See TracTickets for help on using tickets.