SOLVED - Need help to verify my iso.sig

fredmyra · December 1, 2022

I am not sure about how to do the verification.

My searching only resulted in https://www.funtoo.org/GPG_Signatures

my downloaded files look like this:


[arthur@esprimo-II ~]$ cd /run/media/arthur/Storage/Linux_By_Distros/Funtoo/funtoo-220715

[arthur@esprimo-II funtoo-220715]$ ls 
funtoo-livecd-20220715-1607.iso      
funtoo-livecd-20220715-1607.iso.hash.txt
funtoo-livecd-20220715-1607.iso.gpg  
node.txt

Trying to follow the link above I tried:

[arthur@esprimo-II funtoo-220715]$ gpg --keyserver pgp.mit.edu --recv-key D3B948F82EE8B4020A0410789A658306E986E8EE
gpg: key 9A658306E986E8EE: public key "Daniel Robbins (BDFL) <drobbins@funtoo.org>" imported
gpg: Total number processed: 1
gpg:               imported: 1
[arthur@esprimo-II funtoo-220715]$ gpg --edit-key E986E8EE
gpg (GnuPG) 2.2.40; Copyright (C) 2022 g10 Code GmbH
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.


pub  rsa4096/9A658306E986E8EE
     created: 2016-11-28  expires: never       usage: SC  
     trust: unknown       validity: unknown
sub  rsa4096/2E5B26155568E28D
     created: 2016-11-28  expires: never       usage: E   
sub  rsa4096/8C7CC4D18DAD2DBC
     created: 2016-11-28  expires: never       usage: S   
[ unknown] (1). Daniel Robbins (BDFL) <drobbins@funtoo.org>
[ unknown] (2)  [jpeg image of size 5472]

gpg> trust
pub  rsa4096/9A658306E986E8EE
     created: 2016-11-28  expires: never       usage: SC  
     trust: unknown       validity: unknown
sub  rsa4096/2E5B26155568E28D
     created: 2016-11-28  expires: never       usage: E   
sub  rsa4096/8C7CC4D18DAD2DBC
     created: 2016-11-28  expires: never       usage: S   
[ unknown] (1). Daniel Robbins (BDFL) <drobbins@funtoo.org>
[ unknown] (2)  [jpeg image of size 5472]

Please decide how far you trust this user to correctly verify other users' keys
(by looking at passports, checking fingerprints from different sources, etc.)

  1 = I don't know or won't say
  2 = I do NOT trust
  3 = I trust marginally
  4 = I trust fully
  5 = I trust ultimately
  m = back to the main menu

Your decision? 4

pub  rsa4096/9A658306E986E8EE
     created: 2016-11-28  expires: never       usage: SC  
     trust: full          validity: unknown
sub  rsa4096/2E5B26155568E28D
     created: 2016-11-28  expires: never       usage: E   
sub  rsa4096/8C7CC4D18DAD2DBC
     created: 2016-11-28  expires: never       usage: S   
[ unknown] (1). Daniel Robbins (BDFL) <drobbins@funtoo.org>
[ unknown] (2)  [jpeg image of size 5472]
Please note that the shown key validity is not necessarily correct
unless you restart the program.

gpg> quit
[arthur@esprimo-II funtoo-220715]$ gpg --import node.txt
gpg: no valid OpenPGP data found.
gpg: Total number processed: 0

my node.text looked like:

[arthur@esprimo-II funtoo-220715]$ ls node.txt
gpg: key 9A658306E986E8EE: public key "Daniel Robbins (BDFL) <drobbins@funtoo.org>" imported
pub  rsa4096/9A658306E986E8EE
sub  rsa4096/2E5B26155568E28D
sub  rsa4096/8C7CC4D18DAD2DBC

I also tried:

[arthur@esprimo-II funtoo-220715]$ ls node.txt
D3B948F82EE8B4020A0410789A658306E986E8EE
rsa4096/9A658306E986E8EE
rsa4096/2E5B26155568E28D
rsa4096/8C7CC4D18DAD2DBC

and

[arthur@esprimo-II funtoo-220715]$ ls node.txt
D3B948F82EE8B4020A0410789A658306E986E8EE
pub rsa4096/9A658306E986E8EE
sub rsa4096/2E5B26155568E28D
sub rsa4096/8C7CC4D18DAD2DBC

all with the same result. What must I do ?

Edited December 3, 2022 by fredmyra
Unwillingly posted too early

cardinal · December 2, 2022

Problem is here:

[arthur@esprimo-II funtoo-220715]$ gpg --import node.txt
gpg: no valid OpenPGP data found.
gpg: Total number processed: 0

Go here: https://www.funtoo.org/GPG_Signatures/Metro_Plaintext_Keys

The fingerprint of node.txt if done correctly:

$ sha256sum node.txt
3ce0c413d95282fcd3ccc9c8ecbdd67beb03066173ed17f26c8376e55b7a286d  node.txt

Proper output when importing node.txt:

$ gpg --import node.txt
gpg: key 9266C4FA11FD00FD: public key "Daniel Robbins (metro:node) <drobbins@funtoo.org>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   1  signed:   1  trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: depth: 1  valid:   1  signed:   0  trust: 1-, 0q, 0n, 0m, 0f, 0u

Edited December 2, 2022 by cardinal

fredmyra · December 2, 2022

Thanks cardinal !

So I must edit the node.txt file in the right way. But this is still a problem for me.

@ https://www.funtoo.org/GPG_Signatures >:

Quote

Next, head to GPG Signatures/Metro Plaintext Keys and copy and paste the public key ..,

would that be :

D3B948F82EE8B4020A0410789A658306E986E8EE

?????

and

Quote

,,,,and associated signatures for the metro build server....

I think it was here i missed it totally, by using the signatures I got from the output of the command for receiving the key. I think I also missed something in that I was trying to verify the ISO for the LIVE USB, which I assumed I ought to do since there was a "funtoo-livecd-20220715-1607.iso.gpg" file in the mirror I downloaded from. Tomorrow I will try again with this and what you pointed out in mind . Thanks again.

cardinal · December 2, 2022

Copy all the text in the box below :

Paste into a blank file named node.txt and save.

Import node.txt

$ gpg --import node.txt

Verify Daniel Robbins public key and metro:node signed by Daniel Robbins is imported:

$ gpg --list-keys
/home/rj/.gnupg/pubring.kbx
---------------------------
pub   rsa4096 2016-11-28 [SC]
      D3B948F82EE8B4020A0410789A658306E986E8EE
uid           [ultimate] Daniel Robbins (BDFL) <drobbins@funtoo.org>
uid           [ultimate] [jpeg image of size 5472]
sub   rsa4096 2016-11-28 [E]
sub   rsa4096 2016-11-28 [S]

pub   rsa4096 2016-12-10 [SC]
      70ACBB6BFEE7BC572A8941D19266C4FA11FD00FD
uid           [  full  ] Daniel Robbins (metro:node) <drobbins@funtoo.org>
sub   rsa4096 2016-12-10 [E]
sub   rsa4096 2016-12-10 [S]

node.txt

Edited December 2, 2022 by cardinal

fredmyra · December 3, 2022

Perfect ! this not only solved the problem, it also helped me understans what was wrong, namely that I never looked into https://www.funtoo.org/GPG_Signatures/Metro_Plaintext_Keys probably because I wrongly and uncounsciously assumed that that link concerned just stage3 files. Now I understand !

Thanks cardinal !

Sign In

SOLVED - Need help to verify my iso.sig

Question

fredmyra

Link to comment

Share on other sites

4 answers to this question

Recommended Posts

cardinal

Link to comment

Share on other sites

fredmyra

Link to comment

Share on other sites

cardinal

Link to comment

Share on other sites

fredmyra

Link to comment

Share on other sites

Browse

Activity