Git-Mirrors/thgtoa
1
0
Fork 0
mirror of https://github.com/Anon-Planet/thgtoa.git synced 2025-04-21 00:06:32 -04:00
Code Issues Packages Projects Releases Wiki Activity

Cleanup verification page

Browse Source 
Signed-off-by: pterocles <th.thgtoa@disroot.org>
This commit is contained in:
pterocles 2022-08-30 21:39:10 -04:00 committed by Than Harrison
parent e32f894f83
commit e67ec45d1c
1 changed files with 21 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
verify.md
View File

@ -1,10 +1,6 @@
## How to check the files for safety/integrity and authenticity.
## How to check the files for safety/integrity and authenticity:
The PDF and ODT files in this guide are cryptographically signed using GPG and Minisign. Their integrity can be verified with the published SHA256 Chrecksum Hashes on this website.
SHA256 Checksums of all the PDF and ODT files are available here in the [sha256sum.txt](sha256sum.txt) file.
SHA256 Checksums, signatures, and virustotal checks of the releases files (containing the whole repository) are available within release information at <https://github.com/AnonyPla-ng/thgtoa/releases/latest>
The PDF and ODT files in this guide are cryptographically signed using GPG and [Minisign](https://jedisct1.github.io/minisign). Their integrity can be verified with the published SHA256 Checksum hashes on this website. SHA256 checksums of all the PDF and ODT files are available here in the [sha256sum.txt](sha256sum.txt) file. SHA256 Checksums, signatures, and VirusTotal ("VT") checks of the releases files (containing the whole repository) are available within the latest release information at <https://github.com/Anon-Planet/thgtoa/releases/latest> which will be available as soon as we have a stable release.
The GPG signatures for each PDF and ODT files are available here:
- PDF (Light Theme) Main and Mirrors: [guide.pdf.asc](guide.pdf.asc)
@ -30,7 +26,9 @@ Linux:
- From a terminal, run ```sha256sum /full/path/to/your/file```
- Compare the result with the hash in the online checksum files. They should match.
All commits and releases on this repository are cryptographically signed and verified using the same GPG key. Check for the "Verified" tags on each commit or release.
All commits and releases on this repository are cryptographically signed and verified using the same GPG key.
**Check for the "Verified" tags on each commit or release.**
### How to verify the the authenticity and integrity of the files using GPG:
@ -43,11 +41,9 @@ Import the GPG key using the following command from a command prompt or terminal
```gpg --auto-key-locate nodefault,wkd --locate-keys 42FF35DB9DE7C088AB0FD4A70C216A52F6DF4920```
In theory this command should fetch the key from the a default pool server. If this doesn't work, you can also download/view it directly from here: <https://anonymousplanet.org/42FF35DB9DE7C088AB0FD4A70C216A52F6DF4920.asc> <sup>[[Mirror]][12]</sup>
In theory this command should fetch the key from the a default pool server. If this doesn't work, you can also download/view it directly from here: <https://anonymousplanet.org/42FF35DB9DE7C088AB0FD4A70C216A52F6DF4920.asc>
For redundancy, you can also verify the authenticity of this GPG signature using:
As well as the published key on (search for the fingerprint ```42FF35DB9DE7C088AB0FD4A70C216A52F6DF4920```):
As well as the published key on any keyserver below (search for the fingerprint ```42FF35DB9DE7C088AB0FD4A70C216A52F6DF4920```):
- <https://pgp.mit.edu>
- <https://keys.openpgp.org>
- <https://keyserver.ubuntu.com>
@ -66,21 +62,22 @@ This should output a result showing it matches and it's ok.
To verify the files with Minisign:
- You should first dowbload minisign from <https://jedisct1.github.io/minisign/>
- Download the files along with their *.minisig signature file (they should be in the same directory)
- Download the Minisign public key available on the website and repository: [minisign.pub](minisign.pub) (again place it in the same directory for convenience)
- Run the following command in a command prompt or terminal: ```minisign -Vm guide.pdf -p minisign.pub```
- Output should show ```Signature and comment signature verified```
- You should first download minisign from <https://jedisct1.github.io/minisign/>.
- Download the files along with their \*.minisig signature file (they should be in the same directory).
- Download the Minisign public key available on the website and repository: [minisign.pub](minisign.pub) (again place it in the same directory for convenience).
- Run the following command in a command prompt or terminal: ```minisign -Vm guide.pdf -p minisign.pub```.
- Output should show ```Signature and comment signature verified```.
### How to check the safety of the files using VirusTotal:
### How to check the safety of the files using VT:
**Note: we not endorse VT. It should be used with extreme caution and never with any sensitive files due to their privacy policies.**
The PDF and ODT files in this guide have been checked by VirusTotal, see the links below but do not trust them blindly and check the hashes matches and re-upload to VT if needed (**Note that this guide does not endorse VirusTotal. It should be used with extreme caution and never with any sensitive files due to their privacy policies**):
- Light Theme: [[VirusTotal]][light_virustotal]
- ODT file: [[VirusTotal]][odt_virustotal]
The PDF and ODT files in this guide have been checked by VT, see the links below but do not trust them blindly and check the hashes matches and re-upload to VT if needed:
- Light Theme: [[VT Scan]](https://www.virustotal.com/gui/file/21dfa2f7da668156275e4ca2bc82091f347739967a278cf24a062c15a3944016?nocache=1)
- ODT file: [[VT Scan]](https://www.virustotal.com/gui/file/df8554f732dc54b530fd831548f0727934f2e03ad1518ac33061d0995eab2172?nocache=1)
### Additional manual safety checks for the PDF files:
For additional safety; you can always double check the PDF files using PDFID which you can download at <https://blog.didierstevens.com/programs/pdf-tools/> (You might be wondering why should trust a random python script? Well it's open-source and well-known. It's probably a safer bet than trusting a random PDF).
For additional safety; you can always double check the PDF files using PDFID which you can download at <https://blog.didierstevens.com/programs/pdf-tools/>. (You might be wondering, "Why should I trust a random python script?" Well, it's open-source and well-known. It's also probably a safer bet than trusting a random PDF).
Here are the steps:
@ -88,9 +85,9 @@ Here are the steps:
```python pdfid.py file-to-check.pdf```
And you should see the following entries at 0 for safety, this 0 means there is no Javascript or any action that could possibly embed malicious scripts. Normally this won't be neceessary as most modern PDF readers won't execute those scripts anyway.
And you should see the following entries at **0** for safety, this 0 means there is no Javascript or any action that could possibly execute malicious macros, script, etc. Normally this won't be neceessary as most modern PDF readers won't execute those scripts anyway.
```
```bash
/JS 0 #This indicates the presence of Javascript which could be malicious
/JavaScript 0 #This indicates the presence of Javascript which could be malicious
/AA 0 #This indicates the presence of automatic action on opening
@ -101,8 +98,4 @@ And you should see the following entries at 0 for safety, this 0 means there is
/Launch 0 #This counts the launch actions
/EmbeddedFile 0 #This indicates there are embedded files within the PDF
/XFA 0 #This indicates the presence of XML Forms within the PDF
```
[light_virustotal]: https://www.virustotal.com/gui/file/21dfa2f7da668156275e4ca2bc82091f347739967a278cf24a062c15a3944016?nocache=1
[dark_virustotal]: https://www.virustotal.com/gui/file/45d4ed258a202d4f0c49d848d6f52333782e6f912c1b67b1125a442de2ff5b7c?nocache=1
[odt_virustotal]: https://www.virustotal.com/gui/file/df8554f732dc54b530fd831548f0727934f2e03ad1518ac33061d0995eab2172?nocache=1
```