Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #227527 > unrolled thread

Verifying checksum and signature

Started byleonard morin <leonard.morin@gmail.com>
First post2020-10-01 20:30 +0200
Last post2020-10-09 01:00 +0200
Articles 4 — 2 participants

Back to article view | Back to linux.debian.user

Contents

  Verifying checksum and signature leonard morin <leonard.morin@gmail.com> - 2020-10-01 20:30 +0200
    Re: Verifying checksum and signature Ryan Nowakowski <tubaman@fattuba.com> - 2020-10-05 20:30 +0200
      Re: Verifying checksum and signature Ryan Nowakowski <tubaman@fattuba.com> - 2020-10-05 21:30 +0200
      Re: Verifying checksum and signature leonard morin <leonard.morin@gmail.com> - 2020-10-09 01:00 +0200

#227527 — Verifying checksum and signature

Fromleonard morin <leonard.morin@gmail.com>
Date2020-10-01 20:30 +0200
SubjectVerifying checksum and signature
Message-ID<AVbv3-cy-7@gated-at.bofh.it>

[Multipart message — attachments visible in raw view] — view raw

Hi,

I want to reinstall Debian but first verify the signature of the installer
checksum and the signature file. I am working with Windows and based this
process on this video by Crypto Dad:

https://www.youtube.com/watch?v=N7oE0QaK540

I was able to download the GPG4Win and verify it with the Shasum Checker,
also as per Crypto Dad:

https://www.youtube.com/watch?v=QZ2GrQA_ye8

I followed his instructions to check the signature and checksum for the
Debian installer in (GNU Privacy Assistant). I get the message that there
is no public key. When I follow his process to retrieve the public key at
https://www.debian.org/CD/verify
I get the message in GPA "No keys were found" for all the IDs and
fingerprints on the page. Should I be obtaining the public key elsewhere?
Or should I do something else differently?

If you need more details please let me know.

Thanks for your help,
Leonard

[toc] | [next] | [standalone]

#227624

FromRyan Nowakowski <tubaman@fattuba.com>
Date2020-10-05 20:30 +0200
Message-ID<AWDpf-7cj-3@gated-at.bofh.it>
In reply to#227527
On Thu, Oct 01, 2020 at 06:21:54PM -0400, leonard morin wrote:
> Hi,
> 
> I want to reinstall Debian but first verify the signature of the installer
> checksum and the signature file. I am working with Windows and based this
> process on this video by Crypto Dad:
> 
> https://www.youtube.com/watch?v=N7oE0QaK540
> 
> I was able to download the GPG4Win and verify it with the Shasum Checker,
> also as per Crypto Dad:
> 
> https://www.youtube.com/watch?v=QZ2GrQA_ye8
> 
> I followed his instructions to check the signature and checksum for the
> Debian installer in (GNU Privacy Assistant). I get the message that there
> is no public key. When I follow his process to retrieve the public key at
> https://www.debian.org/CD/verify
> I get the message in GPA "No keys were found" for all the IDs and
> fingerprints on the page. Should I be obtaining the public key elsewhere?
> Or should I do something else differently?
> 

You should be able to get the keys from the debian key
server(keyring.debug.org).  Here's any example using gpg from the
command-line:

    tubaman@potts:~$ gpg --keyserver keyring.debian.org --recv-keys 6BD05CFB
    gpg: key 42468F4009EA8AC3: "Debian Testing CDs Automatic Signing Key <debian-cd@lists.debian.org>" not changed
    gpg: Total number processed: 1
    gpg:              unchanged: 1
    tubaman@potts:~$ gpg --fingerprint 6BD05CFB
    pub   rsa4096 2014-04-15 [SC]
          F41D 3034 2F35 4669 5F65  C669 4246 8F40 09EA 8AC3
    uid           [ unknown] Debian Testing CDs Automatic Signing Key <debian-cd@lists.debian.org>
    sub   rsa4096 2014-04-15 [E]

Perhaps you can translate that into your Windows tools?  Here some more
info on Debian's gpg key server: https://keyring.debian.org/

[toc] | [prev] | [next] | [standalone]

#227630

FromRyan Nowakowski <tubaman@fattuba.com>
Date2020-10-05 21:30 +0200
Message-ID<AWElj-7Nt-5@gated-at.bofh.it>
In reply to#227624
On Mon, Oct 05, 2020 at 12:59:26PM -0500, Ryan Nowakowski wrote:
> On Thu, Oct 01, 2020 at 06:21:54PM -0400, leonard morin wrote:
> > Hi,
> > 
> > I want to reinstall Debian but first verify the signature of the installer
> > checksum and the signature file. I am working with Windows and based this
> > process on this video by Crypto Dad:
> > 
> > https://www.youtube.com/watch?v=N7oE0QaK540
> > 
> > I was able to download the GPG4Win and verify it with the Shasum Checker,
> > also as per Crypto Dad:
> > 
> > https://www.youtube.com/watch?v=QZ2GrQA_ye8
> > 
> > I followed his instructions to check the signature and checksum for the
> > Debian installer in (GNU Privacy Assistant). I get the message that there
> > is no public key. When I follow his process to retrieve the public key at
> > https://www.debian.org/CD/verify
> > I get the message in GPA "No keys were found" for all the IDs and
> > fingerprints on the page. Should I be obtaining the public key elsewhere?
> > Or should I do something else differently?
> > 
> 
> You should be able to get the keys from the debian key
> server(keyring.debug.org)

should be "keyring.debian.org"

[toc] | [prev] | [next] | [standalone]

#227703

Fromleonard morin <leonard.morin@gmail.com>
Date2020-10-09 01:00 +0200
Message-ID<AXN3c-1RE-5@gated-at.bofh.it>
In reply to#227624

[Multipart message — attachments visible in raw view] — view raw

Thanks, Ryan. It's resolved now. When I got your email, I decided to do
something I probably should have thought of doing before. I went into my
Debian OS (which I am in the process of reinstalling) and I tried
retrieving the public keys using the signing keys from the same place (
https://www.debian.org/CD/verify ) within Debian, following the commands
you suggested. Of course, I was able to retrieve them. Then what I did was
go back to windows and try Kleopatra instead of Privacy Assistant, and it
worked! What a relief! There's some problem with Privacy Assistant. Perhaps
having it installed on the same Windows system with GPA Privacy Assistant?
I don't know. Thanks again, Leonard

On Mon, Oct 5, 2020 at 2:20 PM Ryan Nowakowski <tubaman@fattuba.com> wrote:

> On Thu, Oct 01, 2020 at 06:21:54PM -0400, leonard morin wrote:
> > Hi,
> >
> > I want to reinstall Debian but first verify the signature of the
> installer
> > checksum and the signature file. I am working with Windows and based this
> > process on this video by Crypto Dad:
> >
> > https://www.youtube.com/watch?v=N7oE0QaK540
> >
> > I was able to download the GPG4Win and verify it with the Shasum Checker,
> > also as per Crypto Dad:
> >
> > https://www.youtube.com/watch?v=QZ2GrQA_ye8
> >
> > I followed his instructions to check the signature and checksum for the
> > Debian installer in (GNU Privacy Assistant). I get the message that there
> > is no public key. When I follow his process to retrieve the public key at
> > https://www.debian.org/CD/verify
> > I get the message in GPA "No keys were found" for all the IDs and
> > fingerprints on the page. Should I be obtaining the public key elsewhere?
> > Or should I do something else differently?
> >
>
> You should be able to get the keys from the debian key
> server(keyring.debug.org).  Here's any example using gpg from the
> command-line:
>
>     tubaman@potts:~$ gpg --keyserver keyring.debian.org --recv-keys
> 6BD05CFB
>     gpg: key 42468F4009EA8AC3: "Debian Testing CDs Automatic Signing Key <
> debian-cd@lists.debian.org>" not changed
>     gpg: Total number processed: 1
>     gpg:              unchanged: 1
>     tubaman@potts:~$ gpg --fingerprint 6BD05CFB
>     pub   rsa4096 2014-04-15 [SC]
>           F41D 3034 2F35 4669 5F65  C669 4246 8F40 09EA 8AC3
>     uid           [ unknown] Debian Testing CDs Automatic Signing Key <
> debian-cd@lists.debian.org>
>     sub   rsa4096 2014-04-15 [E]
>
> Perhaps you can translate that into your Windows tools?  Here some more
> info on Debian's gpg key server: https://keyring.debian.org/
>
>

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web