Dubious signature verification

Hello brothers, I was needing help regarding signatures, I can’t find this signature anywhere on the page (or I haven’t searched well) and I wanted to make sure that I am installing a legitimate ISO, tell me if this one really belongs to someone from the QubesOS team, because the one I have found in several parts is the following: 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494

I will send you the data of my terminal when verifying the signatures:

~/Downloads$ gpg --import qubes-release-4.2-signing-key.asc GPG: Key E022E58F8E34D89F: 1 signature not checked due to lack of a key 
gpg: key E022E58F8E34D89F: "Qubes OS Release 4.2 Signing Key" unchanged 
gpg: Total amount processed: 1 GPG: No change: 1
~/Downloads$ gpg --verify Qubes-R4.2.2-x86_64.iso.asc Qubes-R4.2.2-x86_64.iso 
gpg: Signed on Sat 13 Jul 2024 04:32:26 CEST 
gpg: using RSA key 9C884DF3F81064A569A4A9FAE022E58F8E34D89F 
gpg: Correct Signing of "Qubes OS Release 4.2 Signing Key" [unknown] 
gpg: ATTENTION: This key is not certified by a trusted firm! 
gpg: There is no indication that the firm belongs to the owner. Primary Key Fingerprints: 9C88 4DF3 F810 64A5 69A4 A9FA E022 E58F 8E34 D89F
~/Downloads$ sha256sum Qubes-R4.2.2-x86_64.iso
939df3096cbcafa784b8d9866d9221075b66e69da031a3340bfd7da7c881b08b  Qubes-R4.2.2-x86_64.iso

I am sending this information because I am relatively new and may have done something wrong, although I think I did the verification process well :smiley: I just don’t match the information available on the page

The sha256sum seems legit, according to this. However, to be really sure, you should first import the Qubes Master Signing Key. Only after that you do what did above, and gpg2 should confirm to you that what you have is signed by the Master Key.

1 Like

I just added the signature with the following command:

gpg2 --fetch-keys https://keys.qubes-os.org/keys/qubes-master-signing-key.asc

And indeed I just added it
`

pub rsa4096 2022-10-04 [SC] 9C884DF3F81064A569A4A9FAE022E58F8E34D89F uid [unknown] Qubes OS Release 4.2 Signing Key pub rsa4096 2010-04-01 [SC] 427F11FD0FAA4B080123F01CDDFA1A3E36879494 uid [unknown] Qubes Master Signing Key

But even so he continues to tell me the same thing as before when using the

gpg --verify Qubes-R4.2.2-x86_64.iso.asc Qubes-R4.2.2-x86_64.iso

gpg: ATTENTION: This key is not certified by a trusted firm!
gpg: There is no indication that the firm belongs to the owner. Primary Key Fingerprints: 9C88 4DF3 F810 64A5 69A4 A9FA E022 E58F 8E34 D89F

Check the signatures of the team members and neither do they, none match the one that matters

Did you change the level of trust to the Master Key, as explained in my link? (and I copy it below)

$ gpg2 --edit-key 0x427F11FD0FAA4B080123F01CDDFA1A3E36879494
gpg (GnuPG) 1.4.18; Copyright (C) 2014 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

pub  4096R/36879494  created: 2010-04-01  expires: never       usage: SC
                     trust: unknown       validity: unknown
[ unknown] (1). Qubes Master Signing Key

gpg> fpr
pub   4096R/36879494 2010-04-01 Qubes Master Signing Key
Primary key fingerprint: 427F 11FD 0FAA 4B08 0123  F01C DDFA 1A3E 3687 9494

gpg> trust
pub  4096R/36879494  created: 2010-04-01  expires: never       usage: SC
                     trust: unknown       validity: unknown
[ unknown] (1). Qubes Master Signing Key

Please decide how far you trust this user to correctly verify other users' keys
(by looking at passports, checking fingerprints from different sources, etc.)

   1 = I don't know or won't say
   2 = I do NOT trust
   3 = I trust marginally
   4 = I trust fully
   5 = I trust ultimately
   m = back to the main menu

Your decision? 5
Do you really want to set this key to ultimate trust? (y/N) y

pub  4096R/36879494  created: 2010-04-01  expires: never       usage: SC
                     trust: ultimate      validity: unknown
[ unknown] (1). Qubes Master Signing Key
Please note that the shown key validity is not necessarily correct
unless you restart the program.

gpg> q
1 Like

Thank you very much, I missed that step :grin:
After doing that in the folder where the signature and the ISO file are located, use the command

gpg --verify Qubes-R4.2.2-x86_64.iso.asc Qubes-R4.2.2-x86_64.iso

And if it’s the right one, this is the message that should appear

gpg: Signed on Sat 13 Jul 2024 04:32:26 CEST
gpg: using RSA key 9C884DF3F81064A569A4A9FAE022E58F8E34D89F
gpg: Checking Trusted Database
gpg: Marginals needed: 3 completes needed: 1 Trust Model: PGP
gpg: Level: 0 Validity: 1 Signed: 1 Trust: 0-, 0Q, 0N, 0M, 0F, 1U
gpg: Level: 1 Validity: 1 Signed: 0 Trust: 1-, 0Q, 0N, 0M, 0F, 0U
gpg: Correct Signing of “Qubes OS Release 4.2 Signing Key” [total]

You are welcome! You should only trust the Master Key. All other keys are signed by it, so they are automatically verified.

1 Like