Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #225201 > unrolled thread

Verifying authenticity of Debian CDs

Back to article view | Back to linux.debian.user

Contents

  Verifying authenticity of Debian CDs Semih Ozlem <semihozlemlinuxuser@gmail.com> - 2020-07-24 18:00 +0200
    Re: Verifying authenticity of Debian CDs john doe <johndoe65534@mail.com> - 2020-07-24 18:10 +0200
      Re: Verifying authenticity of Debian CDs john doe <johndoe65534@mail.com> - 2020-07-24 18:40 +0200
    Re: Verifying authenticity of Debian CDs Stefan Monnier <monnier@iro.umontreal.ca> - 2020-07-24 18:30 +0200
      Re: Verifying authenticity of Debian CDs Andrew Cater <amacater@gmail.com> - 2020-07-24 18:40 +0200
        Re: Verifying authenticity of Debian CDs davidson <davidson@freevolt.org> - 2020-07-28 12:00 +0200
      Re: Verifying authenticity of Debian CDs Andrew Cater <amacater@gmail.com> - 2020-07-24 18:40 +0200
      Re: Verifying authenticity of Debian CDs davidson <davidson@freevolt.org> - 2020-07-28 11:50 +0200

#225201 — Verifying authenticity of Debian CDs

[Multipart message — attachments visible in raw view] — view raw

On the web page
https://www.debian.org/CD/verify
I am trying to follow the next paragraph.
"To ensure that the checksums files themselves are correct, use GnuPG to
verify them against the accompanying signature files (e.g. SHA512SUMS.sign).
The keys used for these signatures are all in the Debian GPG keyring
<https://keyring.debian.org> and the best way to check them is to use that
keyring to validate via the web of trust."

when I run the command
gpg --verify SHAxSUM.sign SHAxSUM
I get a message saying that

Can't check signature: No public key

How should I proceed to get the necessary public key.
I tried following the link on this page to https://keyring.debian.org/
but I was not able to follow what to do. I tried simple copy and paste of
commands on this page, or their small variants, but was not able to get any
results.

Can someone help please

Thank you in advance.

Semih Ozlem

[toc] | [next] | [standalone]

#225202

On 7/24/2020 5:50 PM, Semih Ozlem wrote:
> On the web page
> https://www.debian.org/CD/verify
> I am trying to follow the next paragraph.
> "To ensure that the checksums files themselves are correct, use GnuPG to
> verify them against the accompanying signature files (e.g. SHA512SUMS.sign).
> The keys used for these signatures are all in the Debian GPG keyring
> <https://keyring.debian.org> and the best way to check them is to use that
> keyring to validate via the web of trust."
>
> when I run the command
> gpg --verify SHAxSUM.sign SHAxSUM
> I get a message saying that
>
> Can't check signature: No public key
>
> How should I proceed to get the necessary public key.
> I tried following the link on this page to https://keyring.debian.org/
> but I was not able to follow what to do. I tried simple copy and paste of
> commands on this page, or their small variants, but was not able to get any
> results.
>
> Can someone help please
>

If you have internet access, give a shot to the below command:

$ gpg --keyserver-options auto-key-retrieve verify SHA512SUMS.sign
SHA512SUMS

Assuming that it works, the next command will be:

$ sha512sum --strict --ignore-missing -c SHA512SUMS

--
John Doe

[toc] | [prev] | [next] | [standalone]

#225206

On 7/24/2020 6:08 PM, Semih Ozlem wrote:
> No that does not work, for some reason it is saying
> "no command supplied" when corrected with dashes before verify I am getting
> the old problem

Yep, I forgot the dashes befor 'verify'..

'gpg --keyserver-options auto-key-retrieve --verify SHA512SUMS.sign
SHA512SUMS'

--
John Doe

[toc] | [prev] | [next] | [standalone]

#225203

> when I run the command
> gpg --verify SHAxSUM.sign SHAxSUM
> I get a message saying that
>
> Can't check signature: No public key

You should have the needed key(s) in /etc/apt/trusted.gpg, but to be
honest I don't know how to best pass those to GPG.


        Stefan

[toc] | [prev] | [next] | [standalone]

#225204

[Multipart message — attachments visible in raw view] — view raw

And it turns out that /etc/apt/trusted.gpg has the buster-stable, the
buster-automatic and the buster-security keys by default but _NOT_ the
debian-cd signing key so the stage of importing the key to match the
specific Debian CD signing key is still valid.

All best, as ever,

Andy C.

On Fri, Jul 24, 2020 at 4:29 PM Andrew Cater <amacater@gmail.com> wrote:

> I've just written up longer instructions on my own web page at FLOSSlinux
> <https://flosslinuxblog.blogspot.com/> which should explain the steps
> I've just followed for myself. Check those and see what you think. I'll
> have a go at importing from /etc/apt/trusted.gpg and see what that looks
> like. That, of course, is the keyring that apt and aptitude use for master
> verification of Debian packages as part of the verification process before
> package installation - so the master keys for the whole of the trust for
> package installation on a Debian system.
>
> On Fri, Jul 24, 2020 at 4:20 PM Stefan Monnier <monnier@iro.umontreal.ca>
> wrote:
>
>> > when I run the command
>> > gpg --verify SHAxSUM.sign SHAxSUM
>> > I get a message saying that
>> >
>> > Can't check signature: No public key
>>
>> You should have the needed key(s) in /etc/apt/trusted.gpg, but to be
>> honest I don't know how to best pass those to GPG.
>>
>>
>>         Stefan
>>
>>

[toc] | [prev] | [next] | [standalone]

#225412

On Fri, 24 Jul 2020 Andrew Cater wrote:
> And it turns out that /etc/apt/trusted.gpg has the buster-stable, the
> buster-automatic and the buster-security keys by default but _NOT_ the
> debian-cd signing key so the stage of importing the key to match the
> specific Debian CD signing key is still valid.

If you are doing all this on a debian system you trust, the keys you
want are installed by the package

  debian-keyring

in

  /usr/share/keyrings/debian-role-keys.gpg

About one month ago I detailed here how they can be used:

  lists.debian.org/msgid-search/alpine.DEB.2.21.2006240945240.28857@azone.org

-- 
Ce qui est important est rarement urgent
et ce qui est urgent est rarement important
-- Dwight David Eisenhower

[toc] | [prev] | [next] | [standalone]

#225205

[Multipart message — attachments visible in raw view] — view raw

I've just written up longer instructions on my own web page at FLOSSlinux
<https://flosslinuxblog.blogspot.com/> which should explain the steps I've
just followed for myself. Check those and see what you think. I'll have a
go at importing from /etc/apt/trusted.gpg and see what that looks like.
That, of course, is the keyring that apt and aptitude use for master
verification of Debian packages as part of the verification process before
package installation - so the master keys for the whole of the trust for
package installation on a Debian system.

On Fri, Jul 24, 2020 at 4:20 PM Stefan Monnier <monnier@iro.umontreal.ca>
wrote:

> > when I run the command
> > gpg --verify SHAxSUM.sign SHAxSUM
> > I get a message saying that
> >
> > Can't check signature: No public key
>
> You should have the needed key(s) in /etc/apt/trusted.gpg, but to be
> honest I don't know how to best pass those to GPG.
>
>
>         Stefan
>
>

[toc] | [prev] | [next] | [standalone]

#225411

On Fri, 24 Jul 2020 Stefan Monnier wrote:
> [On 24 Jul 2020 Semih Ozlem wrote:]
>> when I run the command
>> gpg --verify SHAxSUM.sign SHAxSUM
>> I get a message saying that
>>
>> Can't check signature: No public key

Somone recently asked a similar question.

In case you already have access to a debian system that you trust, you
might find my reply to them helpful

  24 June 2020, davidson wrote to debian-user
  lists.debian.org/msgid-search/alpine.DEB.2.21.2006240945240.28857@azone.org

along with an edit for clarity:

  lists.debian.org/msgid-search/alpine.DEB.2.21.2006241221420.28857@azone.org

> You should have the needed key(s) in /etc/apt/trusted.gpg, but to be
> honest I don't know how to best pass those to GPG.

I do not have that file on any system at hand. Instead, I have many
debian-archive-*.gpg keyrings in the directory

  /etc/apt/trusted.gpg.d

and I notice that none of them contain Debian CD signing keys.

The the package debian-keyring installs

  /usr/share/keyrings/debian-role-keys.gpg

which most likely contains the optical media signing key needed here.

-- 
Ce qui est important est rarement urgent
et ce qui est urgent est rarement important
-- Dwight David Eisenhower

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web