iso signing and hashes

[cromerc]

I think deployiso should have 2 more options available, one to sign the iso with "gpg -b" and another that generates a hash. It is very important to verify hashes and sigs for the iso to demonstrate that the iso didn't get corrupt during download and that it is signed by a artix dev which means there isn't anyway that something malicous is in the iso.

[udeved]

buildiso has the option to have all this inside the initramfs, its just not activated, and poorly documented.

The checksums for the squash images are created at iso buildtime.

The checksum check can be enabled in grub on iso, supplying the additional argument

checksum

The signing of the squash images can be enabled at iso buildtime, by setting the gpg key in artools.conf

To enable the key verification, this also can be supplied by additional grub argument.

verify

The iso will not boot if checksum or verify fails, or both.

[cromerc]

But that doesn't stop somebody from distributing a fake iso with a different key than ours. The iso needs to be signed after it is fully generated with a .sig file that we upload to SF. If the .sig file does not contain our keys that means it was modified by somebody else who is not a developer of artix. That is the only way to ensure that the iso is from us and not from somebody else who gained ftp access to a server.