From owner-freebsd-security@freebsd.org Sun Jan 10 03:41:42 2016 Return-Path: Delivered-To: freebsd-security@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 76B80A69C46 for ; Sun, 10 Jan 2016 03:41:42 +0000 (UTC) (envelope-from clint@clintarmstrong.net) Received: from mail-ig0-x233.google.com (mail-ig0-x233.google.com [IPv6:2607:f8b0:4001:c05::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4F9BE1CDA for ; Sun, 10 Jan 2016 03:41:42 +0000 (UTC) (envelope-from clint@clintarmstrong.net) Received: by mail-ig0-x233.google.com with SMTP id ik10so103171893igb.1 for ; Sat, 09 Jan 2016 19:41:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=clintarmstrong.net; s=google; h=mime-version:from:date:message-id:subject:to:content-type; bh=jI11xgEcXvohs9HGtnbTG+lxJeerVUDxVZ3Qjd4T9kk=; b=chl8igJFBnZxk+Res3oxsCJMKCt/m467TWu6uBzBl/izmbl/eoDKMwXLF452/fYbSi yqoL6ZnmC5NZmAjfBxcpZ6LIAMCwETnmkPZrr4uPuoTCgDGYx5PLoxWMo4bpwPauACj9 04Gdf23QMGMwmyTRA9Ef7kQtCrjqP8EPSIKFo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:from:date:message-id:subject:to :content-type; bh=jI11xgEcXvohs9HGtnbTG+lxJeerVUDxVZ3Qjd4T9kk=; b=Ce6zxNp+PqURac2k7CD5D+DIiCsL3Zs7vd+3S/PoDgi+3/uZUBxbzThJNGy9lZLzT3 b64YGV9pEzDHM2AS5yesXopz+diV3Ksr104iMnY4lb47wrH8lsU6q0+b2nmw9RKdYJsO 7nXDDbGCjo2KFUxOqDCpOboyD+M9vAYXjWNvvRP8kRdVi47XxBJVmXwkBrkbS/I2u0G5 HdsnlBScZmslim3Fxt60YjjznFzW/AMCs30dQHeYa0e1MSh+nB9iHziOVIcqU9tAhVn8 RCjHXNMWWKUi0YFi9trhK/DBAXZ6hP6emRfsYuexz+SFliP9LtWUzJeUsFbcJG1vrr/M lmvQ== X-Gm-Message-State: ALoCoQl2XuQTFVVlU8a54yJP9hGk0OWHxeie70p/CgRwiE/6bWbwl3/1XFNich1BDItxu9tc/QsGtP1t/g+un4Q6QTJ2w2ZBPg== X-Received: by 10.50.50.228 with SMTP id f4mr6153377igo.6.1452397301263; Sat, 09 Jan 2016 19:41:41 -0800 (PST) MIME-Version: 1.0 From: Clint Armstrong Date: Sun, 10 Jan 2016 03:41:31 +0000 Message-ID: Subject: Signed Checksums for release archives To: freebsd-security@freebsd.org X-Mailman-Approved-At: Sun, 10 Jan 2016 03:48:19 +0000 Content-Type: text/plain; charset=UTF-8 X-Content-Filtered-By: Mailman/MimeDel 2.1.20 X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Jan 2016 03:41:42 -0000 The signed checksums at https://www.freebsd.org/releases/10.2R/signatures.html provide a way to verify installation sources, but there do not appear to be any signed checksums for the release archives at ftp://ftp.freebsd.org/pub/FreeBSD/releases/amd64/amd64/10.2-RELEASE/. Is there another source of signed checksums hosted elsewhere or any other way to verify archive downloads?