@jerry0 contacted me via PM to help with this, sorry it took me so long to get to it. I haven't used my Ledger wallets in over a year. Therefore, I haven't had LedgerLive installed on my system, but I went ahead and downloaded the latest version and set about to verify it.
I found Ledger's instructions on how to verify the checksums here:
https://www.ledger.com/ledger-live/lld-signaturesI downloaded the
.pem file, the
.sig file, and the
.sha512sum file (saved with a .txt extension.) The first thing I noticed is that the checksums file is signed with an OpenSSL key, not GPG. Being a Windows user myself, this created a roadblock right away. I don't have much experience with OpenSSL, let alone OpenSSL in Windows, so I didn't know how to verify the signature. I installed the OpenSSL module that's available through PowerShell package manager, but it doesn't appear to provide a command to validate signatures. I found a third-party package manager that claims to have a module called "OpenSSL.Light" which again claims to work similar to OpenSSL commands on Linux. I didn't install it, because I don't want a third-party anything installed on my system. So, I gave up and used WSL to validate the signature.
In WSL I browsed to the directory where I had saved all the files, and ran this command:
openssl dgst -sha256 -verify ledgerlive.pem -signature ledger-live-desktop-2.36.3.sha512sum.sig ledger-live-desktop-2.36.3.sha512sum.txt
![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.ibb.co%2FVmr4h3L%2FUntitled.png&t=665&c=fkBoHJob-rsNAA)
Kind of a shitty thing to do to Windows users, in my opinion. Why not just use GPG like almost all of the other software vendors in the cryptocurrency space? I've been displeased with Ledger for a variety of reasons, and this ain't helping win me back. Not to mention the lack of security: The OpenSSL certificate, the signature file, and the checksums file are all hosted on the same server. What could go wrong?
Once that was done the rest of it went fairly smoothly. Now that I've confirmed the checksum file was signed with the OpenSSL certificate provided by Ledger I can check the SHA512 hash of the executable file. I was able to do so in PowerShell like I normally do.
I prefer to use
CertUtil to check hash sums:
certutil -hashfile ledger-live-desktop-2.36.3-win-x64.exe sha512
![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.ibb.co%2FmtbqkBL%2FUntitled.png&t=665&c=mA-Djfr-yfGHrg)
The instructions on Ledger's web page suggest to use the
Get-FileHash command, like this:
Get-FileHash ledger-live-desktop-2.36.3-win-x64.exe -Algorithm SHA512
But that's not great. As you can see below, when using that command it truncates the results, only showing a portion of the hash. As HCP suggested earlier in this thread you can add "
| Format-Table -Wrap" to the end of the command, and the complete results will be displayed. Here's the full command:
Get-FileHash ledger-live-desktop-2.36.3-win-x64.exe -Algorithm SHA512 | Format-Table -Wrap
![](https://ip.bitcointalk.org/?u=https%3A%2F%2Fi.ibb.co%2FDrJZQgc%2FUntitled.png&t=665&c=O1NA9Iv8zO8mXA)
@jerry0 was concerned because the result he got were all in capitol letters. As you can see above, the hash sum is the same regardless of which utility you use, but
Get-FileHash displays the results with all capitol letters, while
CertUtil provides the results with all lower-case letters. It doesn't appear that the hash sum is case-sensitive.