Lion Cipher Lab
Verify a software release signature and catch a tampered artifact
- Cyber / Security Engineer
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Supply-chain attacks — where the software you install is compromised before it ever reaches you — are now one of the most damaging classes of breach, because one poisoned release fans out to everyone who trusts it. The instinct most people have, "I checked the checksum, so the download is safe," is exactly the gap attackers walk through: whoever controls the download page controls the checksum next to it. Learning in your hands why a signature tied to a trusted key is a fundamentally stronger promise than a checksum — and why even a signature is worthless if you trust the wrong key — is the…
What you'll learn
- the difference between integrity (checksums) and authenticity (signatures)
- generating an Ed25519 key pair with openssl
- creating and verifying a detached signature
- reasoning about supply-chain trust anchors and out-of-band key distribution
- recognizing when a signature check is theatre
Steps in this lab
- The question a checksum can't answer
- Set up a scratch folder and confirm openssl is there
- As the maintainer: create a signing key pair
- As the maintainer: build a release, then publish a checksum AND a signature
- As the user: verify the honest release (both checks pass)
- As the attacker: tamper the file AND re-publish a matching checksum
- The payoff: checksum says OK, signature says FAIL
- The honest catch: a signature you verify against the WRONG key
- How the pros do it — and what to actually reach for