Re: Missing GnuPG signatures for checksums

[Julien Cristau <jcristau@debian.org>]

On Mon, Apr 20, 2020 at 06:38:48PM +0200, Laurențiu Păncescu wrote:
> Hello,
> 
> I'm trying to put a preseed file on the same USB stick as the installation,
> using hd-media/boot.img.gz is easier than remastering the iso. It works, but
> there seems not to be any signed checksum file for these images and they are
> served only over http:
> 
> http://http.us.debian.org/debian/dists/buster/main/installer-amd64/current/images/
> 
> How can I check if these images are authentic? I guess I could mount a
> signed CD iso like netinst, copy vmlinuz and initrd from there and create my
> own USB stick with syslinux - is there a better way?
> 
Hi,

http://http.us.debian.org/debian/dists/buster/InRelease is signed and contains
checksums for the d-i SHA256SUMS file.  (I realize that still makes
verification awkward.)

Cheers,
Julien