1

I'm wondering about the correct steps when you want to download Firefox from their server and validate it has not been tampered with.

Assume you download the latest Firefox tar-bz2-package from https://download.mozilla.org with wget. Is this already enough to ensure integrity since it's using https?

Is there an additional way to verify the author of this package? There is an additional asc-file in the same directory where I got the tar-bz2-file from. I can use this asc- file with gpg to verify the tar-bz2-file. But how can I be sure that this asc-file is also from the intended party?

There is a key I imported as mentioned on https://blog.mozilla.org/security/2023/05/11/updated-gpg-key-for-signing-firefox-releases/ , but I'm not sure how this connects to the asc-file downloaded for each release.

What would be the correct steps and commands to validate validity of the binary from https://download.mozilla.org?

13
  • We have tons of Q&As on this topic.
    – schroeder
    Commented May 15 at 9:25
  • I did those steps. But can I know that the downloaded asc-file is not refering to a completely different identity? It does not answer the core of my question.
    – Gere
    Commented May 15 at 9:30
  • That's where the other links help. You can't. That's not that this process is for.
    – schroeder
    Commented May 15 at 9:31
  • You can't? There should be a way that someone shares the identity with me and I validate files from other sources? I trust the public key I downloaded from Mozilla. Now I only need to ensure the asc-file refers to the right identity. But how? Is there an ID, a fingerprint or something to tie the asc-file to Mozilla?
    – Gere
    Commented May 15 at 9:36
  • Well, if you did the steps in the last link, that's exactly what you are looking for. If you want validation of the validation, as you seem to be asking, that's not what the process is set up for.
    – schroeder
    Commented May 15 at 9:38

0

Browse other questions tagged .