Pre-Installation, Verifying Signatures: 'FAILED' and 'BAD signature'

User Support
1

Hi, Qube nube / Linux nub here. :joyful_coiled_up_poop:

Before I retry installing R4.1.2, I’m re-following the ‘verifying signatures’ guide, when using Gpg4Win on windows I get:

$ gpg -v --verify Qubes-R4.1.2-x86_64.iso.asc Qubes-R4.1.2-x86_64.iso
...
gpg: Good signature from "Qubes OS Release 4 Signing Key"

But with the same files I get some bad indications when using gpg2 on linux (arch).
Below seems fine:

$ gpg2 -v --verify Qubes-R4.1.2-x86_64.iso.DIGESTS                             
gpg: enabled compatibility flags:
gpg: armor header: Hash: SHA256
gpg: original file name=''
gpg: Signature made <date was here>
gpg:                using RSA key 5817A43B283DE5A9181A522E1848792F9E2795E9
gpg: using pgp trust model
gpg: Good signature from "Qubes OS Release 4 Signing Key" [full]
gpg: textmode signature, digest algorithm SHA256, key algorithm rsa4096

Below seems wrong, and i don’t know if this means the file is tampered or something else:

$ md5sum -c Qubes-R4.1.2-x86_64.iso.DIGESTS                                    
Qubes-R4.1.2-x86_64.iso: FAILED
md5sum: WARNING: 20 lines are improperly formatted
md5sum: WARNING: 1 computed checksum did NOT match

… it’s same result message for md5, sha1, sha256, sha512

And then:

$ gpg2 -v --verify Qubes-R4.1.2-x86_64.iso.asc Qubes-R4.1.2-x86_64.iso
gpg: enabled compatibility flags:
gpg: Signature made <date was here>
gpg:                using RSA key 5817A43B283DE5A9181A522E1848792F9E2795E9
gpg: using pgp trust model
gpg: BAD signature from "Qubes OS Release 4 Signing Key" [full]
gpg: binary signature, digest algorithm SHA256, key algorithm rsa4096

I get the same results when using torrent files.
Should I avoid booting with this iso?

2

Yes.

What the verifications are saying:

  • your DIGESTS file was downloaded correctly, and is authentic

  • the ISO file fails the digest check (MD5, SHA1, etc) so it is not the expected file. The most likely explanation is that there was an error during download or copy.

  • since the ISO file is not the expected one, it is expected that it also fails the signature verification

You should download it again or copy it again, since it seems like the file you had on your Windows machine was correct. :slightly_smiling_face:

3 Likes
3

thanks for the reply! will retry.