Skip to main content
G
Gojomo
Participant
October 22, 2014
Answered

Any way to download Reader from a secure/authenticated source?

  • October 22, 2014
  • 1 reply
  • 1145 views

All links I can find result in a plain-HTTP download, which can be undetectably tampered with in transit.

Even changing the plain HTTP Adobe - Adobe Reader download - All versions to HTTPS Adobe - Adobe Reader download - All versions still results in a plain-HTTP download.

The @8954872 twitter account suggested secure FTP to ftp.adobe.com, but SFTP doesn't provide source-server authentication (nor does ftp.adobe.com even seem to answering SFTP).

Publishing the official secure checksums of the installers via a secure authenticated channel would also be good, but I couldn't find those anywhere, either. A Google search for the actual SHA1 of the executable I received (54fd10c7d36895469f6bfb1cd01ec04a633f8c5d for 'AdobeReaderInstaller_11_en_ltrosxd_aaa_aih.dmg') had no hits, suggesting official checksums haven't been prominently announced.

Adobe's auto-update mechanisms must be secured by crypto against tampering in transit, right? So why isn't the initial download?

Any pointers appreciated.

- Gordon

This topic has been closed for replies.
Correct answer AbhigyanModi

This is the download from Adobe's download center which involve Adobe's download manager downloading the bits. One you mount the dmg, you can verify using the codesign tool:

$ codesign -vvv /Volumes/Adobe\ Reader\ Installer/Install\ Adobe\ Reader.app

You can also download complete Mac installers (sans the download manager) from:

ftp://ftp.adobe.com/pub/adobe/reader/mac/11.x/11.0.09/en_US/AdbeRdr11009_en_US.dmg (full installer)

ftp://ftp.adobe.com/pub/adobe/reader/mac/11.x/11.0.09/misc/AdbeRdrUpd11009.pkg (updater pkg)


For the PKG extracted from the full 11.0.9 installer DMG

$ pkgutil --check-signature Adobe\ Reader\ XI\ Installer.pkg

For the update PKG:

pkgutil --check-signature AdbeRdrUpd11009.pkg

1 reply

AbhigyanModi
AbhigyanModi
Participating Frequently
October 24, 2014

All downloads are digitally signed. Would verifying the signature achieve your objective?

G
GojomoAuthor
Participant
October 24, 2014

Yes, verifying an Adobe signature of the download would assure me it's authentic.

How can I verify the signature of 'AdobeReaderInstaller_11_en_ltrosxd_aaa_aih.dmg'? Is the signature embedded in the download itself?

- Gordon

AbhigyanModi
AbhigyanModiCorrect answer
Participating Frequently
October 25, 2014

This is the download from Adobe's download center which involve Adobe's download manager downloading the bits. One you mount the dmg, you can verify using the codesign tool:

$ codesign -vvv /Volumes/Adobe\ Reader\ Installer/Install\ Adobe\ Reader.app

You can also download complete Mac installers (sans the download manager) from:

ftp://ftp.adobe.com/pub/adobe/reader/mac/11.x/11.0.09/en_US/AdbeRdr11009_en_US.dmg (full installer)

ftp://ftp.adobe.com/pub/adobe/reader/mac/11.x/11.0.09/misc/AdbeRdrUpd11009.pkg (updater pkg)


For the PKG extracted from the full 11.0.9 installer DMG

$ pkgutil --check-signature Adobe\ Reader\ XI\ Installer.pkg

For the update PKG:

pkgutil --check-signature AdbeRdrUpd11009.pkg

Firefly Community Gallery
Adobe Firefly

Remix with Firefly Community Gallery

Thousands of free creations to fall in love with and remix in Firefly.

Explore now
Terms & ConditionsAccessibility statement
Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices