When manually installing Beta 7 (because the built-in updater failed for a second time in a row), I was greeted with this message:
Now, I don’t remember if this very same thing happened previously with the other beta images.
I’m interested to learn the reason why this image isn’t signed, which would add an additional layer of security to the download and installation process.
I had to run a malware scan on it (virustotal.com + another malware scanner), which while it is always a good practice, most of the times isn’t necessary if the image is signed.
If this is an intended behavior and you will keep providing us with unsigned, potentially unsafe images through the development cycle, please consider adding a checksum or two next to the download link in order to allow us to check that what we downloaded is what we intended to download.
Yes, I saw that the file is hosted on an AWS S3 bucket, which should be enough secure by itself, but we know that in the past installation files from other vendors were compromised and turned into malware delivery systems.
Adding a simple hash next to the download link, what I’m pretty sure would be easy enough to automate using a CI/CD system, would be a good security practice specially when dealing with untrusted images.
Thanks