Qubes master signing key: 102 signatures not checked

[fatlazycat]

I recently installed v4.2 of Qubes. And fetched the master signing keys from the ubuntu keyserver. This is what i get:

[user@disp7357 ~]$ gpg2 --keyserver-options no-self-sigs-only,no-import-clean --keyserver hkp://keyserver.ubuntu.com --recv-keys 0x427F11FD0FAA4B080123F01CDDFA1A3E36879494

gpg: key DDFA1A3E36879494: 102 signatures not checked due to missing keys
gpg: key DDFA1A3E36879494: “Qubes Master Signing Key” 103 new signatures
gpg: no ultimately trusted keys found
gpg: Total number processed: 1
gpg: new signatures: 103

I find this odd because I have not seen the part of ‘signatures not checked’ before. Why would so many signatures have missing keys - does it mean that the developers who signed the master key do not have their keys verified.

Is this a serious issue.

Regards
flc

[adw]

@fatlazycat

I recently installed v4.2 of Qubes. And fetched the master signing keys from the ubuntu keyserver. This is what i get:

[user@disp7357 ~]$ gpg2 --keyserver-options no-self-sigs-only,no-import-clean --keyserver hkp://keyserver.ubuntu.com --recv-keys 0x427F11FD0FAA4B080123F01CDDFA1A3E36879494

gpg: key DDFA1A3E36879494: 102 signatures not checked due to missing keys
gpg: key DDFA1A3E36879494: “Qubes Master Signing Key” 103 new signatures
gpg: no ultimately trusted keys found
gpg: Total number processed: 1
gpg: new signatures: 103

I find this odd because I have not seen the part of ‘signatures not checked’ before.

Already answered in the FAQ: https://www.qubes-os.org/security/verifying-signatures/#why-am-i-getting-x-signature-not-checked-due-to-a-missing-key

@fatlazycat

Why would so many signatures have missing keys

Because lots of random people decided to sign it, and you don’t have their keys (which you shouldn’t care about).

@fatlazycat

does it mean that the developers who signed the master key do not have their
keys verified.

No.

@fatlazycat

Is this a serious issue.

No, not even a little bit.