Checksums and pgp signatures

[luneth]

Hi,
I’d like to move my current setup to hass.io, and first verify the downloaded image, but I can’t seem to find any checksums or signature anywhere…
Do you guys have any suggestion?
Thanks!

[silvrr]

Verify Home Assistant

Good morning I am writing to ask you what is the correct procedure to verify the integrity of Home Assistant once downloaded, recalculating the Checksum to compare it with the Checksum calculated by the developers, and to check the PGP signature of the checksum so as to be sure that Home Assistant has not been tampered with. Thank you very much Have a nice day

Incase this gets answered in the other thread.

[PiuCurioso]

Hi Luneth also I would like to understand how to verify the integrity and authenticity of Home Assistant, but I can’t find the CHECKSUM and CHECKSUM.sign check codes anywhere

[luneth]

Any news? Devs maybe?

[bolovanos]

Hi, this topic seems to be ignored - what a pitty.

In my case - I have put up KVM version of HA on Debian. Source was downloaded from this page Linux - Home Assistant (home-assistant.io) . List of these releases is located on github , but again without checksum.
I would appreciate checksum on every HAOS instance prepared for download. As well as checksum of Add-on’s visible on trusted web and than logged in HAOS during installation.
Maybe I am wrong and this is somehow possible - than I am sorry and I would appreciate help.

If I am right, than main benefit of having home automation without third party involved (compared to cloud based one) is not possible.

Is it planned? According to this: WTH - Open source project without open roadmap we cannot tell.