Improve secure installation media preparation process for Windows and Mac users

[andrewdavidwong]

The problem you're addressing (if any)

Verifying Signatures was written primarily with Linux in mind. It needs to be improved for Windows and Mac users.

Describe the solution you'd like

Add or enhance instructions for Windows and Mac users.

Where is the value to a user, and who might that user be?

People coming from Windows and Mac will be able to verify the Qubes ISO on their current systems.

Describe alternatives you've considered

Pointing to external documentation. It'd be nicer if we could provide exact commands that will work.

Additional context

https://github.com/QubesOS/qubes-doc/pull/1076

https://qubes-os.discourse.group/t/iso-verification-instructions-cli-commands-arent-recognized-by-my-non-qubes-cli/1373

Relevant documentation you've consulted

https://www.qubes-os.org/security/verifying-signatures/

Related, non-duplicate issues

None found.

[andrewdavidwong]

I've added a "Preparation" section that points out programs for Windows and Mac users. Unfortunately, however, I don't have access to such systems for testing commands writing specific documentation for those OSes.

@PROTechThor, any chance you might want to do this?

[enjeck]

I've added a "Preparation" section that points out programs for Windows and Mac users. Unfortunately, however, I don't have access to such systems for testing commands writing specific documentation for those OSes.

@PROTechThor, any chance you might want to do this?

@andrewdavidwong Sorry, I can't help here. I don't have those systems either.

[DemiMarie]

One idea would be to write a download tool and sign it with an ITL code-signing certificate. That avoids users needing to worry about verifying the keys themselves, since the tool would be signed with a certificate trusted by Windows.

[deeplow]

One idea would be to write a download tool and sign it with an ITL code-signing certificate. That avoids users needing to worry about verifying the keys themselves, since the tool would be signed with a certificate trusted by Windows.

Good point. If I were windows user (unfamiliar with GPG) verification would probably be very daunting and there would be some steps that I wouldn't probably be able to make securely (Even a lot of qubes users don't do this properly).

Tails has overcome this burden similarly to your suggestion @DemiMarie instead making a Firefox extension: the Tails Verfication. So they instead delegate the trust to mozilla. Some of their reasons:

• Using HTTPS to download. But in the case of Tails, we are serving so many downloads that we have to rely on mirrors hosted by third parties. HTTPS also doesn't protect from interrupted downloads leading to broken Tails installations.

• Providing OpenPGP signatures. But this really works only for the few people who know how to verify an OpenPGP signature and use the OpenPGP Web-of-Trust correctly.

Something else they don't mention but is equally valid is that by making a browser extension, it works for both mac, windows and linux.

[andrewdavidwong]

Thanks to Qubes Forum user catacombs for pointing out that Tails has replaced their browser extension verification method with JavaScript that runs on the download page:

https://tails.boum.org/news/verification_extension_deprecation/index.en.html

https://tails.boum.org/contribute/design/download_verification/

https://qubes-os.discourse.group/t/news-of-download-verification-on-tails-linux/1874

[DemiMarie]

:disappointed:

[TranceV4]

Jesus… just decided to impossible to get this qubes for who have such windows that’s makes me feel an another one thanks!

[DemiMarie]

My recommendation is to offer a USB creator signed by proper Windows and macOS code-signing certificates.

[deeplow]

My recommendation is to offer a USB creator signed by proper Windows and macOS code-signing certificates.

Not sure if this is what fedora does, but if there is a way to go about making installation I think it should be theirs. They have installers for windows and macos and for linux they suggest the iso route. The macos and windows could be signed installers as you suggest. the only limitation would be to have to go through the process of getting a developer key...

[andrewdavidwong]

Generalized title to allow for non-documentation solutions.