Hi, linux-service: > This gives me a verified iso:
Sure. Some drawbacks include: - The "3.16" bits have to come from somewhere that can be trusted. - Depending on the environment this script is run in, you may be trusting only our current signing key, or our current signing key and older ones, or any key in the user's keyring. - Any ISO image that got signed by one of the aforementioned keys will pass this verification. So the mirror you're using could send users an old ISO and the script would still be happy. It has happened in the past that our Upgrader was broken in a Tails release, so this may lead to users running a dangerously obsolete Tails without noticing. So yeah, automated installers and upgraders are a hard problem :/ Cheers, -- intrigeri _______________________________________________ Tails-dev mailing list [email protected] https://www.autistici.org/mailman/listinfo/tails-dev To unsubscribe from this list, send an empty email to [email protected].
