Re: Security Concern: setup.exe signature difficult to verify

2009-05-20 Thread Doug Bateman
Greg Chicares Wrote: > Here's a native msw binary: > ftp://ftp.gnupg.org/gcrypt/binary/gnupg-w32cli-1.4.9.exe Thanks for the response Greg. This still raises 2 concerns: 1) If this method is the official cygwin authenticity verification procedure, it should be well documented on the website, as

Re: Security Concern: setup.exe signature difficult to verify

2009-05-19 Thread Greg Chicares
On 2009-05-20 03:03Z, Doug Bateman wrote: > > Yes, you can download http://www.cygwin.com/setup.exe.sig. However > you won't find mention of that on the website. > Sadly, to check this signature you have to already have gpg.exe > installed. This of course requires you already have cygwin install

Security Concern: setup.exe signature difficult to verify

2009-05-19 Thread Doug Bateman
Today, I was downloading cygwin, and discovered how challenging it really is to verify the authenticity of setup.exe.  Typically there are 3 ways an executable can be verified: Method 1) Windows supports signed exe files.  When you first execute an exe, windows first shows a window allowing you to