How to verify the .iso.asc file?

User Support General
1

I remember that qubes os would have checksums to verify against. Now it is changed. Can anyone explain if this command verifies the iso.asc?

gpg2 -v --verify Qubes-RX-x86_64.iso.asc Qubes-RX-x86_64.iso

Does this command verify the iso.asc against the rsk or maybe qmsk. Also if I want to reverify the USB stick with this command on another pc

dd if=/dev/sdX bs=1M count=<SIZE> iflag=count_bytes | gpg -v --verify Qubes-RX-x86_64.iso.asc -

Do I have to run the top command again for it verify the iso.asc . Does the command above after the pipe which takes the data and passes it to the gpg just compare the data against the iso.asc or verifies the iso.asc against rsk and then compares data from pipe.

2

You should be able to find the digest files now but maybe it is not so easy to find. See the context for their temporary removal: Stop using PGP cleartext signatures · Issue #10512 · QubesOS/qubes-issues · GitHub

The method using only the detached signature is fine (and to me easier). Check the output here: Verifying signatures — Qubes OS Documentation It should tell you gpg: Good signature from "Qubes OS Release 4.3 Signing Key" so using the iso, the detached signature and the (previously imported) RSK, gpg should be able to verify the file

3

So in the last command after the pipe gpg verifies the iso.asc against rsk? Thanks

4

I don’t know what is the proper way to describe that in the GPG world, but if you have imported the RSK, this is how you actually verify your media, and it involves the RSK, yes.

5

What I mean is, with these two commands will they verify the iso.asc against an already verified qmsk or rsk? It doesn’t make sense for me.

6

That’s approximately like this: the QMSK only serves to authenticate the RSK and the RSK produces the detached signature.