Security Proposal for TeX Live ============================== (last change NP 2016-01-04) We use md5 sums in the following places: 1) md5sum of the texlive.tlpdb in texlive.tlpdb.md5 in tlnet/tlcritical and all the normal dists 2) md5 sum of *location* string of remote end - if the database is present (tlpkg/texlive.tlpdb.MD5SUM) and the md5sum downloaded from 1) and the saved md5sum agree, do not redownload the remote tlpdb but use local copy 3) md5sum of containers (.tar.xz) are checked now only during installation, after my commit also from tlmgr It would make sense to replace some or all of the above with sha256. 2) is the only one we could keep as md5, but I propose that if we switch, then we switch all the md5 to sha256. In principle my idea about security setup is as follows: For the installer * installer packages are sha256 hashed (already done!) * the sha256 files are gpg signed with our gpg tlnet key * our public gpg key is included in texlive.infra package For the rest (installation or update from remote) * install-tl/tlmgr downloads the texlive.sha256.gpg and texlive.sha256 * verifies that this is ok * if yes, download the texlive.tlpdb and check the sha256 value of it (this is the reason we should switch from md5 to sha256, as md5 is AFAIR fakeable) * if all succeed, do the usual verification of each container only by sha256 (instead of md5) There is no need to sign each container, as we are having indirectly signed sha256 hashes of the containers (in the tlpdb, which is sha256-ed, and then signed). Usage: * if gpg is found, try to use it, otherwise just give warning about how to verify/gpg necessary * only if gpg is available, download .sha256.asc and verify