Few people have any idea what a pgp/gpg sig or a hash is. People believe software should handle all that complex stuff. They're right.
Give them one command that downloads and verifies. They'll verify every time.
We can make it even simpler for your users, with free customized version for you that has your download url and verification data built in. No command line params. Just tell people to run it.
Safeget is free and open source.
Safeget requires python3. You can run it on Windows, Linux, or Mac OS X.
If your operating system offers a safeget package, install it.
But safeget isn't in many package managers yet. Get it from PyPi with:
Or download the safeget-installer and run it:
Windows users: If you do not have GPG installed on your Windows computer, then you'll need to run Safeget as an administrator the first time you run it so that Safeget can install GPG onto your system. To open a command prompt as an administrator, start to search for "command prompt". An area near the search box appears with an option to "Execute as administrator". Select that option and then you can issue any Safeget command.
You can publish a Safeget command. Or get a free simple custom Safeget.
Option #1: You can let DeNova create a custom no-parameter Safeget for free. For example, we created a custom Safeget installer for Bitcoin Core with Safeget itself and all the parameters built in.
python3 safeget-bitcoin-core
Your users just download the custom installer and run it.
They don't have to install anything first.
It's really hard to get it wrong.
Option #2: You publish one command for your users that shows all the details. The more checks you specify, the safer your users are. It's good practice to publish your Safeget command through multiple channels.
Here's an example of using Safeget with one command for Bitcoin Core:
safeget \
https://bitcoin.org/bin/bitcoin-core-0.21.0/bitcoin-0.21.0-x86_64-linux-gnu.tar.gz \
--pubkey https://raw.githubusercontent.com/bitcoin-core/bitcoincore.org/master/keys/laanwj-releases.asc \
--signedhash SHA256:https://denova.com/open/safeget/hashes/bitcoin-core-0.21.0/SHA256SUMS.asc
With either option, Safeget takes the same steps:
When a parameter is a url, Safeget searches that web page for what it needs. For example, a pgp signature can be buried in text. Safeget checks the protocol, downloads the page, and extracts the sig.
To make it even simpler for your users, we're happy to create a free customized version of Safeget for you. so your users just issue a one word command. No command line params. Your custom Safeget has your download and verification data embedded. Then just tell people to run your one word command.
Safeget checks:
Want more checks? Let us know.
Safeget solves the question of which verification sources and methods to trust: Don't trust any of them too much. The solution is a defense in depth, using multiple hosts and algorithms.
Safeget is completely decentralized with no gatekeeper. There's no single point of failure.
Because Safeget can check many hashes in addition to pgp/gpg signatures, it's highly resistant to quantum computing attacks.
Most file verification relies on a single host or algorithm. But no one really knows which ones are safe. Safeget checks as many as you like.
Safeget can get corroboration from multiple sources. Safeget can verify a file based on the file's source, pgp keys, pgp file signature, pgp signed hashes, explicit hashes, and more. You can spread the information across different hosts and use multiple hash algorithms. Everything has to agree for a file to verify.
Sideloading, downloading files from unofficial sources, is risky. Safeget can make sideloading much safer.
You don't have to rely on DeNova's host. Put your Safeget command on your own host.
You can specify as many checks as you like, all in one command. Then wrap it all in a simple custom safeget.
The more checks, the more certain you are that the file is valid. It is extremely unlikely that a bad file will pass multiple hash algorithms. You might find yourself calculating the time needed to find a multiple hash collision in HDOU units — "Heat Death of the Universe".
Of course, Safeget's not perfect. You still have the risk that someone cracks your own system. But since you are security conscious enough to encourage people to verify, you probably can protect your own system. Users are very likely to get your real Safeget and Safeget protects very effectively against MITM attacks.
In practice, when you use Safeget with multiple signed hashes attackers will have to bypass or attack Safeget itself.
Safeget is distributed as open source, in a single python file, so it's easy to audit the code. Please do.
You can tell Safeget to run a program after it's done. It's a great way to launch installers. With one command you can download, verify thoroughly, and install.
If you see a "SyntaxError: invalid syntax", then you probably are trying to run Safeget with python2. It's a bug in python2. Use python3.
Most people don't verify. Maybe they don't quite understand how or why. Even security pros sometimes skip it.
Instead of telling your users to follow a long and complex procedure they'll often skip, download and verify with Safeget.
It doesn't matter if they don't know what a pgp/gpg sig or hash is. With Safeget, users verify files.
Copyright 2019-2021 DeNova.
Safeget is open source, licensed under GPLv3