re: creating rc5.iso $ cd qubes-secpack/,$ git tag -v `git describe`,,I get "object not found"

[socks]

I'm sure it's the newb in me, but I'm trying to verify the rc5.iso  and getting stuck here:

https://www.qubes-os.org/security/pack/

Step 4.

Verify signed Git tags.

$ cd qubes-secpack/
$ git tag -v `git describe`

I get "object not found" 

proceeding in the /canaries  , it's ok 

[Andrew David Wong]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Cannot reproduce. Following those exact steps works for me. Perhaps
there was a typo?

- --
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEZQ7rCYX0j3henGH1203TvDlQMDAFAlqtcw0ACgkQ203TvDlQ
MDAOWQ/9Ek3SUOJJzZ1Wf3GwYY5tI5ZkUvqObkTFqluhCyNgAwzGE/X4YXfeaJwj
/07zdXpsih6nBpHm2SZOGggSEgP0rFQYMdS49GIPvIceujuREI0ol6GtqPesrG02
ID5Vkwu4rvpt9OMVei4MInhml41mRT6M3SkO3S+JwP/x4lJpUrHV2rG0dtrNna8b
Dy4rrKOvqP0i0xUNDHVGEvnATCcHT7el/ndSpwo070+6Y4hCTSCqKFsKNtvnCiiA
1CbOjWeSSHi6tb+UtVhoneSXO1vqDtIsviHy2546ZtvdzWRIH+uhsmGmNyRRdOtq
CZb3W5Z7D5zRQRttVpsdSsOLl0/xjyOVecu2ACBhWpkxOnZeIe0pOcxHSG8P6hlx
bD5SbaqQ5BeGEx1+xmAaIGKbqQawt43/gEjfZiUFEZQYXS35C4G/Fky4InNUwsky
t7YE2tAYyLXwYm4+N/buCqKdWDxXJDibZ747LRSfkpdb7a8QnkAPJPf2Kgnz3Q8m
6trZbHG2yrsS7WeKK8OiYjMeIhB5DJgJdMzAsHNnGkc04A/zPx81RNI9/gneqHF6
pCo1jleWkXXQzGRLHrXXNX7t9LieDaXXDqEqDiSc0DP2KjgBtuel660fNR3gzXQG
jt7RjQWfINT2OSZd9ZDrgX2aice6TR/+NRs/R2j6R53yqt8V/PE=
=FZe4
-----END PGP SIGNATURE-----

[socks]

Intriguingly I also get this :


desktop ~/Downloads/Qubes-R4.0-rc5-x86_64 $ md5sum -c
Qubes-R4.0-rc5-x86_64.iso.DIGESTS
Qubes-R4.0-rc5-x86_64.iso: OK
md5sum: WARNING: 22 lines are improperly formatted


so:  is this .iso  OK  or ?

[Andrew David Wong]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

That's normal:

https://ask.fedoraproject.org/en/question/10956/checksum-verification-error-message-is-mysterious/

- --
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEZQ7rCYX0j3henGH1203TvDlQMDAFAlqtdjkACgkQ203TvDlQ
MDCdfxAAnUrscoBDk/E1MAvVS7UgMP/dluC2VnTAW6aNIm8D0iGDRApjN4kpdm3f
QRtrJhcMTIC5tg9Vyo8hEb78qNvi24pP41TuywOaUfs94mUpHO/44+X6t+y0Emzp
MJkL1whpFKNM1qz6Kgh9TmfB00NHElNmUgz4fXQ3eXSgRlsO6JstiCQOO4XIzvYa
DYqaSwENeJUSp9ImFJBK01OJtHWmp5xEMWlEnt4W9D0XWCSlJm2+Nh0zPcEXS8+2
Gn72ibVkMrmU6rzcedAnbQvAGNHeisJCH9ZGHZ0qItROLH6IO9PepQ7Yeo3bw/pT
YGqafU4ePLeasdYVgg3jA3PHsCcrhkm1R3J8/FsPl6FqUsYER7nQkbHvIe8t3XxI
qNFU6SBxcWbOpjtTJBdSWLLuSV/6hkzJ0MDvvxyzc+ksLE9WhRWN/71pzDb1iJJ1
GVv3UiB3TP5oVMF9d1I3fArG5boilOlfZiJ1YYuc5V68rWIfsg+3dAVOavFZABN3
J8IQkpU0KvM6wFHarQKDr4X38k/huksRcKxJS1TgD4tVezEK028sV+xBk1Q5glyx
BK29WBNJzPQ55nxZC/dKaX5nTK8Do3d9QhQzGo921/2PExPqn5vCQRHWf4N4AZNP
aJxeHPxPxj4eVhhmKUvuDP3GR+cQhFkT7ANfQesb7AOVSW/ksNI=
=aDZR
-----END PGP SIGNATURE-----

[Andrew David Wong]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 2018-03-17 15:10, Andrew David Wong wrote:
> On 2018-03-17 15:07, socks wrote:
>> On 03/17/2018 08:37 AM, socks wrote:
>>> I'm sure it's the newb in me, but I'm trying to verify the rc5.iso and
>>> getting stuck here:
>>>
>>> https://www.qubes-os.org/security/pack/
>>>
>>>
>>> Step 4.
>>>
>>> Verify signed Git tags.
>>>
>>> |$ cd qubes-secpack/ $ git tag -v `git describe` I get "object not
>>> found" proceeding in the /canaries , it's ok |
>>>
>>>
>> Intriguingly I also get this :
>
>
>> desktop ~/Downloads/Qubes-R4.0-rc5-x86_64 $ md5sum -c
>> Qubes-R4.0-rc5-x86_64.iso.DIGESTS
>> Qubes-R4.0-rc5-x86_64.iso: OK
>> md5sum: WARNING: 22 lines are improperly formatted
>
>
>> so: is this .iso OK or ?
>
>
> That's normal:
>
> https://ask.fedoraproject.org/en/question/10956/checksum-verification-error-message-is-mysterious/
>

By the way, this is already thoroughly explained in our documentation:

https://www.qubes-os.org/security/verifying-signatures/#verifying-digests

- --
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEZQ7rCYX0j3henGH1203TvDlQMDAFAlqt7MMACgkQ203TvDlQ
MDB7zg/+L51BthFM82dgxFzXqRjR3ecJyv+xSN/G3GgSHxW/93pD4SDwfhBf9vB5
2dk1zztAMCG6x+ssemfNn+N/tV25DaLMeOeFhmanI5RKUhaXj3u/5KIarQvz38DP
0bwMpFX5XjPBsby/5WHeR/wCuMmf0Plj1sBeLUI9y8Y/ZeNKOON4uts60DzuYb/d
Kvfht0xKxAf1+rPVWRHkJLNv1N3uF+zxovs7cLQwS7rx2FlFbCa9Xne1QRpc93+2
9kT1YWzSuV8xraaRkjzlaOCu0fak5mlScWbAQLGHqBykR6hKGX7ydjDXWHn1tN4+
tHHmTRuuiiiJ87p70BG9e4ngx4or+3BiLfkc02772vN6jRnki0a9t4+xXCObKWrJ
JqtBo7F/OrszJYoQhHotllZBxv4sGIOdh/5Mv+U3z53si/ErywrClT871CC2SUwQ
Xo7Fn0GfnAq4vOha4RBV8uJxQo6tVqDxjP4Djcciu40/F1DfTydNh7yD4KI0/fI3
FJFa0HIQaxtoQNEjGoa8AkkYJgQJEzWxGrfPZDwBrNTQ/0h4bYMDljabHmhNpQyb
jwRDEz7SzmZy0YLRPvFOQumYvYFVgWF/A8Ke2ficwTPJBMRckGx1LDEvESCgdJke
SACPgjUISfPbq+lkgzTPO0C23ebGn+Ycd5ClpsHKvsUzajDBMYk=
=fnym
-----END PGP SIGNATURE-----