sha256sum of vmware.ova

[rancherr]

Hello,
Since newest images are moved from github to factory.talos.dev - I was wondering where are the sha256sum files?
I downloaded file from https://factory.talos.dev/image/903b2da78f99adef03cbbd4df6714563823f63218508800751560d3bc3557e40/v1.8.1/vmware-arch64.ova
but not able to find the sha256sum files.
Does anyone know where to find it ?

Cheers.

[smira]

The file is generated on the fly (or cached), and signed internally by the Image Factory, so sha256 doesn't exist. As it's delivered over TLS, you can trust its integrity.

[rancherr]

Thanks a lot for fast response!

[davralin]

The file is generated on the fly (or cached), and signed internally by the Image Factory, so sha256 doesn't exist. As it's delivered over TLS, you can trust its integrity.

While this is true, that means I can't verify it afterwards, which I think would be nice for more compliance-ridden companies.

You already have the infra to sign stuff for SecureBoot, so I assume it's feasible to have a signed sha256sum also?

Also: siderolabs/image-factory/issues/152

Would be nice to have a sha256sum so proxmox can verify the download as it's going:

[smira]

What exactly is the concern here? As the download happens over TLS already, data integrity is guaranteed on the wire.

There is no way to precompute sha256 for the .ova, and disk images are not reproducible (due to the timestamp drift), so sha256 even if available won't add anything. It would be computed over the same image as you download, and if the cache is dropped, next time you download, sha256 might be different.

Talos Linux produces fully reproducible (bit-by-bit) initramfs, kernel, extension images, installer image and imager image. These base artifacts are used by the Image Factory to produce any other output, but not all outputs are reproducible. So if you don't want to trust Image Factory, you'd have to implement your own image building process and protect it yourself.