How to verify 1Password download

userpass

Why isn't 1Password download available through SSL? How am I supposed to know that the binary hadn't their integrity compromised?

Ben

Hi userpass



Are you referring to the auto-updater or a manual download?



A manual download over SSL may be possible using this URL: https://agilebits.com/downloads



Thanks

dteare

Welcome to the forums, userpass.



We use CacheFly as our primary Content Delivery Network and at this time they do not provide SSL support.



The good news is the 1Password application itself is signed using Apple's codesign utility. After downloading, you can validate the signature using this command:



[code]codesign -vvv -R="identifier ws.agile and anchor trusted" /Applications/1Password.app[/code]



You should see output as follows:



[code]/Applications/1Password.app: valid on disk

/Applications/1Password.app: satisfies its Designated Requirement

/Applications/1Password.app: explicit requirement satisfied[/code]





[quote name='bwoodruff' timestamp='1312981956' post='38263']

A manual download over SSL may be possible using this URL: [url="https://agilebits.com/downloads"]https://agilebits.com/downloads[/url]

[/quote]



That shows our web site in secure mode, but the downloads still come from one of our CDNs, each of which don't support SSL yet.

Ben

Thanks for the assist, Dave. <img src='http://forum.agilebits.com/public/style_emoticons/<#EMO_DIR#>/smile.png' class='bbc_emoticon' alt=':)' />

dteare

[quote name='bwoodruff' timestamp='1312994019' post='38305']

Thanks for the assist, Dave. <img src='http://forum.agilebits.com/public/style_emoticons/<#EMO_DIR#>/smile.png' class='bbc_emoticon' alt=':)' />

[/quote]



No problem <img src='http://forum.agilebits.com/public/style_emoticons/<#EMO_DIR#>/biggrin.png' class='bbc_emoticon' alt=':D' />

jpgoldberg

I'd just like a add a note for people who get caught out by a strange codesign thing. The path to 1Password.app needs to look like a pathname instead of some other argument to codesign.



So if you are looking at 1Password.app in the current directly, you will need to run the command as



[code]

codesign -vvv -R="identifier ws.agile and anchor trusted" ./1Password.app

[/code]



The ./ is required there.



Cheers,



-j