1

Normally, The Document Foundation (TDF) publishes the SHA-256 and SHA-1 hashes, along with the MD5 checksum, for all LibreOffice releases. For example, see this.

However, for their current release (v7.1.4), TDF did not publish any hashes or even a checksum (see this and this).

Besides compiling from the source code, what is the next best way to verify the authenticity of the downloads received on any (or all) of the mirrors listed in the referenced files?

(Related note: Most malware scanners actually do next to nothing when scanning MSI files, and the LibreOffice installer file is much too large to upload to VirusTotal. Not that either of those techniques validate authenticity, but at least they can reduce the risk of malware.)

9
  • 1
    The link you have shared has digitally signed binaries. Is hash really necessary?
    – saurabh
    Jun 11, 2021 at 7:46
  • @saurabh Good question. I don't know. How can one verify the digitally signed binaries are actually signed by The Document Foundation and not someone else who created signatures using the same name, but changing a single character to a Unicode character that looks identical but technically has a different value? Also, do you know why the TDF normally posts the hashes if they are superfluous? Jun 11, 2021 at 13:38
  • @saurabh I posted this question to help answer your good question: security.stackexchange.com/questions/251286/… Jun 11, 2021 at 13:54
  • 1
    You can verify through PKI where their certificate chain is validated against root CA and you will check that root CA is from trusted third party like DigiCert, QuoVadis, comodo or one you can trust. But yes, there is no way to find out if their own key is compromised while you are downloading until they release statement or inform CA. CA will revoke the key and you need to keep your system updated with latest CRL.
    – saurabh
    Jun 11, 2021 at 14:03
  • 1
    Refer to this for verification steps sslsupportdesk.com/…. You can also check signtool or Get-AuthenticatedSignature command on Windows OS
    – saurabh
    Jun 11, 2021 at 14:30

0

You must log in to answer this question.

Browse other questions tagged .