Re: [qubes-users] Failed to verify R4.0 rc2 digests

[Andrew David Wong]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 2017-11-11 14:34, nicholas roveda wrote:
> I've just finished to download all the files for R4.0 rc2, but the verification failed.
>
> gpg --verify Qubes-R4.0-rc2-x86_64.iso.asc Qubes-R4.0-rc2-x86_64.iso.DIGESTS
> gpg: Signature made Sat Oct 21 10:10:36 2017 BST using RSA key ID 9E2795E9
> gpg: BAD signature from "Qubes OS Release 4 Signing Key"'
>

It looks like your command is a bit off.

If you're trying to verify the PGP signature on the ISO with this
command, the second argument should be the .iso file, not the .DIGESTS
file.

If you're trying to verify the PGP signature on the .DIGESTS file
itself, only that file should be specified.

This is covered in more detail here:

https://www.qubes-os.org/security/verifying-signatures/

- --
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJaB4l/AAoJENtN07w5UDAwHsYP/R4FeJfEfSk5xvlrbjYD7RgL
WfnV7sq3gLVO/FYk9TFy9Jmt6RpQD0CBBbntBNl/WKQ+p8NLson8crizglYo8JZv
YzZtT3gp8TI2B4OGns3JTSoYMIKJGPOXcw02Z8k5VtQ7m/sr4IVAaI2gN6xnuetS
JNDJPiqu9mJWaG3hGv4Ox0zEQQHkAdTwI8scVG88ozV/JclEChyb4JkLppRWizht
JyIJtG/wWGcjvMMxnEB3rqtaXh7TfK7XqEEUfZmjnfZmF5OdKEdbsz6S2/TjKx5b
UmEnm/ozHx42q31nItx0+cREM2F84V7MmAyFZAkD4WECvtkCC+uQiYbN7NzaMMW1
PNAFnQfl9KS0jHnO9AcfYiEgi1D/SDl1UyzYEBmQi/kwU7tq5Nwclka3xqZ2qmVs
t+HEPKHzADsYJM6STxUo5ugG0xQ9BdHoZfm13pk/rMRgN0ok5gXML5BV4bAQXDPT
9hPyZMuvQUkQuiC1RRrQesoNJRLmSjAQ1QWqhQqvyn7CVh5W6PBwXVPHNLtEFwAr
0//iFCe5pSV1NM0Lzqr9yW6kG2zvb7urb1Kl7Ms1tcJJYeqR/GOgRX2DbLeScIim
u+W3VpCtqhlC1cB0tELX8my37l2KH/5oAmEbwM/v+svq697JaYkqpyZuFq/KZHNI
xQAy2wsRT1KugkIpemU/
=I3qB
-----END PGP SIGNATURE-----