Problem with the certificate of @unman

User Support
1

Hi @unman ans everyone.

Big fan of your work besides the fact that there seem to always missing a step in your documentation about changing or importing your key.

I think I have scrolled through 6 threads now mentioning a problem with that key of yours. And sure there seem to be resolved after some time but yet again I am confronted with a problem with your key.

so your key is up to date.

I have deleted several times in dom0 and checked back it again. This is the good pubkey finishing by C2EF, expiring in 2027.

I have copied it in several place even if it is normally not supposed to be necessary, should a tool like rpmkeys take care of that ? Anyway not my point.

I have put it under the name you suggested in /etc/qubes/repo-templates/keys/ and even in /etc/pki/rpm-gpg/ just to be sure

But when I tried to validate your templates whether it is in personal qube where I did all the download or dom0, It tells me that using the certificate finishing by C2EF (your identity): Certificate finishing by C2EF does not contain key finishing by B36C or that it is not valid. .

So the verif fails. The installation is not done.

When I retried to import with rpmkeys or gpg the key is said unchanged.

And I did use the gpg —keyserver … —armor —export … > …

Tried simply the —recv-keys in personal qube too and no, nothing.

Everything seems up to date.

And since the message is verbose enough to give me your right Certificate ID, I really don’t see what am I missing…

So a little bit of help and maybe if we could in the same time upgrade the documentation with a troubleshooting section thanks to this thread=> that would be marvellous.

Any help would be much appreciated.

Thanks in advance

2

In dom0 - run these commands and show the output for each command.

gpg --delete-key unman
gpg -k
gpg --import /etc/qubes/report-templates/keys/RPM-GPG-KEY-unman
gpg -k

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.

3

No luck. Same error message.

And yes I have seen your typo in your command so don’t worry I have corrected it.

Whether I use the qvm-template or the simple rpm -K (just to check) it gives the same consistent error message.

And yes gpg -k gives me the same signature you have been giving in your GitHub and everywhere else with the right expiration date and the right public key ID

=> still no key inside the certificate…

4

Was there a good reason why you did not show the output as I had asked?

I never presume to speak for the Qubes team. When I comment in the Forum I speak for myself.
5

Ow shit sorry I did miss that part! My bad totally.

Give me a minute.

6

Is there a chance you missed something else then too?

This is how @unman helped me, in case you didn’t try it, which I don’t know, because you never mentioned it:

7

Can you also say which version of Qubes you are using, and which
template you are trying to install?

8

Here you go

[unknown@dom0 ~]$ qvm-template --keyring /etc/qubes/repo-templates/keys/RPM-GPG-KEY-unman install /home/unknown/Downloads/qubes-template-kali-core-4.3.0-202602070337.noarch.rpm 
error: Verifying a signature using certificate 4B1F400DF25651B53C4141B38B3F30F9C8C0C2EF (unman (Qubes OS signing key) <unman@thirdeyesecurity.org>):
  Certificate 8B3F30F9C8C0C2EF does not contain key 7473414DF9A181A45244BDACFDD1B8244731B36C or it is not valid
ERROR: Signature verification failed: -: digests SIGNATURES NOT OK

[unknown@dom0 ~]$ gpg -n --import --import-options import-show unman.asc
pub   rsa4096 2016-06-25 [SC]
      4B1F400DF25651B53C4141B38B3F30F9C8C0C2EF
uid                      unman (Qubes OS signing key) <unman@thirdeyesecurity.org>
sub   rsa4096 2016-06-27 [S] [expires: 2027-06-30]
sub   rsa4096 2016-06-25 [E]

gpg: Total number processed: 1
[unknown@dom0 ~]$ gpg --import unman.asc
gpg: key 8B3F30F9C8C0C2EF: "unman (Qubes OS signing key) <unman@thirdeyesecurity.org>" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1
[unknown@dom0 ~]$ rpm -K Downloads/qubes-template-kali-core-4.3.0-202602070337.noarch.rpm 
Downloads/qubes-template-kali-core-4.3.0-202602070337.noarch.rpm:error: Verifying a signature using certificate 4B1F400DF25651B53C4141B38B3F30F9C8C0C2EF (unman (Qubes OS signing key) <unman@thirdeyesecurity.org>):
  Certificate 8B3F30F9C8C0C2EF does not contain key 7473414DF9A181A45244BDACFDD1B8244731B36C or it is not valid
 digests SIGNATURES NOT OK
[unknown@dom0 ~]$ gpg --delete-key unman
gpg (GnuPG) 2.4.5; Copyright (C) 2024 g10 Code GmbH
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.


pub  rsa4096/8B3F30F9C8C0C2EF 2016-06-25 unman (Qubes OS signing key) <unman@thirdeyesecurity.org>

Delete this key from the keyring? (y/N) y
[unknown@dom0 ~]$ gpg -k
[unknown@dom0 ~]$ gpg --import /etc/qubes/report-templates/keys/RPM-GPG-KEY-unman
gpg: can't open '/etc/qubes/report-templates/keys/RPM-GPG-KEY-unman': No such file or directory
gpg: Total number processed: 0
[unknown@dom0 ~]$ gpg --import /etc/qubes/repo-templates/keys/RPM-GPG-KEY-unman
gpg: key 8B3F30F9C8C0C2EF: public key "unman (Qubes OS signing key) <unman@thirdeyesecurity.org>" imported
gpg: Total number processed: 1
gpg:               imported: 1
[unknown@dom0 ~]$ gpg -k
/home/unknown/.gnupg/pubring.kbx
---------------------------------
pub   rsa4096 2016-06-25 [SC]
      4B1F400DF25651B53C4141B38B3F30F9C8C0C2EF
uid           [ unknown] unman (Qubes OS signing key) <unman@thirdeyesecurity.org>
sub   rsa4096 2016-06-27 [S] [expires: 2027-06-30]
sub   rsa4096 2016-06-25 [E]

[unknown@dom0 ~]$ qvm-template --keyring /etc/qubes/repo-templates/keys/RPM-GPG-KEY-unman install /home/unknown/Downloads/qubes-template-kali-core-4.3.0-202602070337.noarch.rpm 
error: Verifying a signature using certificate 4B1F400DF25651B53C4141B38B3F30F9C8C0C2EF (unman (Qubes OS signing key) <unman@thirdeyesecurity.org>):
  Certificate 8B3F30F9C8C0C2EF does not contain key 7473414DF9A181A45244BDACFDD1B8244731B36C or it is not valid
ERROR: Signature verification failed: -: digests SIGNATURES NOT OK

[unnknown@dom0 ~]$ rpm -K Downloads/qubes-template-kali-core-4.3.0-202602070337.noarch.rpm 
Downloads/qubes-template-kali-core-4.3.0-202602070337.noarch.rpm:error: Verifying a signature using certificate 4B1F400DF25651B53C4141B38B3F30F9C8C0C2EF (unman (Qubes OS signing key) <unman@thirdeyesecurity.org>):
  Certificate 8B3F30F9C8C0C2EF does not contain key 7473414DF9A181A45244BDACFDD1B8244731B36C or it is not valid
 digests SIGNATURES NOT OK
[unknown@dom0 ~]$

Sorry I am don’t have my whole setup installed so I am not connecting to the forum on that specific laptop.

@corporateblush and yes of course it is totally possible but I did go through your thread last night 4 times (not exaggerating. And repeating the exact same step again and again. Not a change

@unman normally every is up to date.

Qubes: R4.3.1

Kernel: 7.0.14-1

Xen: 4.19.5

I am trying to install every template you have besides the noble Ubuntu version. And the previous version of openbsd.

So again, having spent hours retracing steps again and again I am out of clues here.

I can give you the content of your key files too if you want but if there was a problem the tool should have picked it up no?

9

I verified on a clean 4.3.1 using my signing key taken from GitHub and
from keyservers.
For both, it was only necessary to copy the key in to dom0, and move it
to the location specified - /etc/qubes/repo-templates/keys/RPM-GPG-KEY-unman
I could then install templates without issue, manually and from the
repository.
The instructions at https://qubes.3isec.org/Templates_4.3/ work exactly
as stated. No further steps needed.

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.

10

Well I don’t understand then.

It is your key, your template. And you are the expert. So where should I look since I did all that like at least 7 times in total.

And you have seen the output, so it is not like the system did not get that a new key was not integrated …

11

I have seen the output and it is clear that the new key was not
integrated.

I suggest you go back to a clean slate.
gpg --delete-key unman
rpmkeys --list - Note the UUID for unman
rpmkeys --delete-key UUID
rm -rf /etc/pki/rpm-gpg/RPM-GPG-KEY-unman
rm -f /etc/qubes/repo-templates/keys/RPM-GPG-KEY-unman

Delete any downloaded keys from dom0.

Then follow the instructions:
Get a key from a keyserver - check again GitHub.
Transfer key to dom0
copy key to /etc/qubes/repo-templates/keys/RPM-GPG-KEY-unman
Copy repo definition to /etc/qubes/repo-templates/
qvm-template list
qvm-template install TEMPLATE_NAME

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.

12

What do you mean ?

The gpg tool clearly stated your key and its content as you wanted. So which output is for you the proof of an integrated key then?

13

Look at the use-

qvm-template --keyring /etc/qubes/repo-templates/keys/RPM-GPG-KEY-unman install /home/unknown/Downloads/qubes-template-kali-core-4.3.0-202602070337.noarch.rpm                                                   
error: Verifying a signature using certificate
4B1F400DF25651B53C4141B38B3F30F9C8C0C2EF (unman (Qubes OS signing key)
<unman@thirdeyesecurity.org>):                                                                               
  Certificate 8B3F30F9C8C0C2EF does not contain key
7473414DF9A181A45244BDACFDD1B8244731B36C or it is not valid                                                                                                                    
ERROR: Signature verification failed: -: digests SIGNATURES NOT OK

Have you followed my clean slate suggestion?
With what result?

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.

14

Sorry I am trying to figuring family shit right now.

But I have cleaned up some time to redo for the 8th (because I promise you I did all that already) this procedure as you described and film it (I need to figure that shit out still) so you can believe me that it does not work (if it fails again of course).

15

So, I copied the updated key unman.asc from GitHub - unman/unman · GitHub

to /etc/qubes/repo-templates/keys/RPM-GPG-KEY-unman

when I try to install a template, I’m getting this

Downloading 'qubes-template-kali-core-0:4.3.0-202602070337'...
qubes-template-kali-core-0:4.3.0-202602070337:   0%| | 0.00/228M \[00:00<?, ?B/s\]error: Verifying a signature using certificate 4B1F400DF25651B53C4141B38B3F30F9C8C0C2EF (unman (Qubes OS signing key) <unman@thirdeyesecurity.org>):
Certificate 8B3F30F9C8C0C2EF does not contain key 7473414DF9A181A45244BDACFDD1B8244731B36C or it is not valid
Error canonicalizing file: Signature forged!

If you have any insights, it’d greatly appreciate

16

this here is a very very vague instruction and will cause a lot of confusion for a lot of people (me included). When you say this, do you mean the unman.asc that is found here GitHub - unman/unman · GitHub

17

this here is a very very vague instruction and will cause a lot of confusion for a lot of people (me included). When you say this, do you mean the unman.asc that is found here GitHub - unman/unman · GitHub
From that page:

The public key I use for Qubes OS signing is unman.asc

I never presume to speak for the Qubes team. When I comment in the Forum I speak for myself.
18

then that key is giving the errors I posted above

Downloading ‘qubes-template-kali-core-0:4.3.0-202602070337’…
qubes-template-kali-core-0:4.3.0-202602070337: 0%| | 0.00/228M \[00:00<?, ?B/s\]error: Verifying a signature using certificate 4B1F400DF25651B53C4141B38B3F30F9C8C0C2EF (unman (Qubes OS signing key) [unman@thirdeyesecurity.org](mailto:unman@thirdeyesecurity.org)):
Certificate 8B3F30F9C8C0C2EF does not contain key 7473414DF9A181A45244BDACFDD1B8244731B36C or it is not valid
Error canonicalizing file: Signature forged!
19

the actual key to use is not unman.asc from GitHub but the key from here

the pub rsa one to be exact

20

That is **the same key as on GitHub" which I pushed to the keyserver.
I’ve run through this again without any issues.

To be clear, I also re-exported the public key, and posted that again to
GitHub. Checked and working.

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.