Cryptografically signed ISO images

[RW]

On Mon, 3 Mar 2014 19:31:52 +0200
Reko Turja wrote:

> -----Original Message----- 
> From: RW
> 
> On Mon, 3 Mar 2014 10:21:46 -0600 (CST)
> Valeri Galtsev wrote:
> 
> >> Yes, but: if you verified the certificate of https host, you can be
> >> sure that ftp on the same IP address is owned by the same people.
> 
> > The IP addresses of www.freebsd.org and ftp.freebsd.org are
> > different, but even if they weren't that wouldn't protect against
> > man-in-the-middle attacks.
> 
> Hmm, grab the sha256 checksum of iso image from 
> https://freebsd.org -address. Compare the said checksum to the
> downloaded image. The certainty that the image isn't tampered with
> should be strong enough.

We're going in circles.

If such HTTPS checksum links exist, they are not obvious.  The main ISO
links on the "Getting FreeBSD" page go to FTP, the HTTP links on the
mirrors page don't appear to support HTTPS.