Question / Help Verify download sha keys

[Jason Guto]

Folks,
I am looking for the verification keys to verify my download. I cannot find sha keys - can someone point me to them.

Thank you

 

[Boildown]

If you mean something like this: https://en.wikipedia.org/wiki/SHA-3

You're right, I don't see it. You might ask in the OBS Studio thread, or PM Jim. But so far I don't think they've been posting them when they post new executables.

 

[Jason Guto]

If you mean something like this: https://en.wikipedia.org/wiki/SHA-3

You're right, I don't see it. You might ask in the OBS Studio thread, or PM Jim. But so far I don't think they've been posting them when they post new executables.

That is correct - I am looking for the SHA1 or SHA256 keys.

I can find the software on SourceForge
https://sourceforge.net/projects/obsproject/files/?source=directory
and there it has the SHA1 and MD5 keys;however,
it is an older version 6.0b

 

[Fenrir]

The installer is signed. Why exactly do you need a hash?

 

[Jason Guto]

The installer is signed. Why exactly do you need a hash?

I am looking for the SHA keys to trust the authenticity of the install file. Anyone could be hosting the application and sign the installer; however, only the "official" release will be hashed with a checksum in SHA1 or SHA256.



Something like this:

https://wiki.centos.org/TipsAndTricks/sha256sum

 

[Jason Guto]

If you mean something like this: https://en.wikipedia.org/wiki/SHA-3

You're right, I don't see it. You might ask in the OBS Studio thread, or PM Jim. But so far I don't think they've been posting them when they post new executables.

Who is Jim?

 

[Fenrir]

I am looking for the SHA keys to trust the authenticity of the install file. Anyone could be hosting the application and sign the installer; however, only the "official" release will be hashed with a checksum in SHA1 or SHA256.



Something like this:

https://wiki.centos.org/TipsAndTricks/sha256sum

I don't think you understand what signing is.

 

[Osiris]

I am looking for the SHA keys to trust the authenticity of the install file. Anyone could be hosting the application and sign the installer; however, only the "official" release will be hashed with a checksum in SHA1 or SHA256.



Something like this:

https://wiki.centos.org/TipsAndTricks/sha256sum

If the installer is not signed with the same certificate as the installer from obsproject.com, then you know it's not the original. But if you want the SHA keys generate them from the downloads on obsproject.com.

 

[R1CH]

A file hash does not guarantee authenticity, only integrity. All official OBS releases are signed by "Open Source Developer, Hugh Bailey" (Jim) as a means to provide both authenticity and integrity.