[tor-bugs] #5913 [Tor bundles/installation]: Check hashes for the packages downloaded during TBB build

[Tor Bug Tracker & Wiki]

#5913: Check hashes for the packages downloaded during TBB build
--------------------------------------+-------------------------------------
 Reporter:  amieiro                   |          Owner:  erinn       
     Type:  enhancement               |         Status:  needs_review
 Priority:  normal                    |      Milestone:              
Component:  Tor bundles/installation  |        Version:              
 Keywords:                            |         Parent:              
   Points:                            |   Actualpoints:              
--------------------------------------+-------------------------------------

Comment(by amieiro):

 Following Shondoit's suggestion I changed the Makefile to use cut instead
 of awk to parse shasum's output. This is commit 45cbb9107 in my branch
 (https://github.com/flavioamieiro/torbrowser/commit/45cbb9107). This does
 feel more natural (at least to me). It would be great if you guys could
 test this on Windows and OSX (I've tested on Archlinux, but I can't see
 how this wouldn't work on debian, or any other GNU/Linux distro).

 Also, it would be great if someone else could check the hashes I've put in
 the Makefile. I've checked signatures for all the packages that had them
 available (or at least that I could find sigs for), and for the rest I
 just had to trust my connection.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/5913#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online