[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-bugs] #3897 [Tor Browser]: TBB build does insecure download of source files
#3897: TBB build does insecure download of source files
-------------------------+--------------------------------------------------
Reporter: tmpname0901 | Owner: mikeperry
Type: defect | Status: new
Priority: normal | Milestone:
Component: Tor Browser | Version: Tor: 0.2.2.32
Keywords: | Parent:
Points: | Actualpoints:
-------------------------+--------------------------------------------------
A recent post on the Tor blog reminds us, in the wake of the DigiNotar
debacle, of the importance of verifying signed files after downloading.
So why then does the TBB build process download Tor source files
insecurely, then fail to verify the signatures of the files?
See file ~/build-scripts/versions.mk, most recently found in the tor-
browser-2.2.32-2-src.tar.gz tarball. First it explicitly ignores the
certificate of the originating site ("wget --no-check-certificate") while
getting the Tor and Vidalia source. Then it fails to download the
signature files and check them against the downloaded source tarball
files.
I urge that signed files actually be validated against their signatures in
those cases where signatures are available.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/3897>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs