Curious that the OP suggested that. I've downloaded software that doesn't provide a signature file for the binaries, but instead includes a PGP signed list of checksum hashes. I can't remember if it's TOR browser of Oracle VM that does that, but it seems like a viable way of doing it, even if it requires an second step and knowledge of both PGP, and how to check for hash values.
It's something I've thought about in the past, why doesn't Electrum publish their checksum hashes? A lot of us old-timers have been verifying the checksum of downloaded software for some time now.
It's something I've thought about in the past, why doesn't Electrum publish their checksum hashes? A lot of us old-timers have been verifying the checksum of downloaded software for some time now.
it doesn't make any difference to provide the PGP signature of the file itself or provide hash of the file and then PGP signature of the hash. i don't yet know why some projects do it but they do it nonetheless. for instance Ubuntu does exactly this. under Linux both of these steps take only two steps to write a small line in terminal so it is not that big a deal.
besides under the hood things are happening the same way! for example when you are verifying PGP signature you first compute hash of the file then check the signature versus that. so hashing is still a part of it.
