This:Checking hashes alone is of limited use. What if an attacker totally compromised the website, and changed the hashes to match his malicious replacement of the downloadable files? Whereas the PGP signing keys should be stored and used with much higher security than can be expected of the webserver. I think that fluffypony (now binaryfate as the signer?) probably knows how to handle PGP keys. ;–)
I have not reviewed the linked guides. I did skim the beginning of the Windows beginner guide, and noticed an omission: It does not explain how to verify the Gpg4win download, when you do not have PGP/GPG installed.
Chicken-and-egg problem? Not quite: The Gpg4win maintainers have a Microsoft Authenticode signing key,
* so that you can bootstrap trust using built-in Microsoft Windows features:
https://gpg4win.org/package-integrity.htmlThat is always the
first link that I provide to Microsoft Windows users whom I am tutoring in PGP usage. I suggest that somebody involved in the Monero Project should add this link to the Windows verification guide, with a concise additional explanation, and perhaps some more screenshots of what this actually looks like in current versions of Microsoft Windows. The pertinent part of the guide:
https://src.getmonero.org/resources/user-guides/verification-windows-beginner.htmlI did a few more test.
First I scan also installer from version 0.15.0.1 (which I am using now without problems). Main computer: no virus. Backup computer: virus!. Humm...
Also I use virustotal.com for both files. Both have half a dozen virus detected, but no GREAT virus (most of them coinminer or related things).
I am "almost sure" it is a false positive.
Please don’t waste your time and effort. For this purpose, “antivirus” software is of negligible (
i.e., practically zero) help—even negative help:
If you trust the Monero lead devs, then the PGP-signed hash file does what you want: It proves that you are installing the software that they themselves provided to you. If you don’t want to trust, then nothing short of a thorough code audit will suffice.