New TemplateVMs Signatures/Master Signing Key

[Yiyi50]

If you download a new TemplateVM inside an existing Qubes system, using "sudo qubes-dom0-update qubes-template-debian-xx" does that download have a signature file that needs to be verified with the Qubes Master Signing key? And if yes, how do I do that? If the Master Signing Key isn't in Dom0, but the mirror image is downloaded within Dom0, how can I verify it?

Please note: I'm only started with Qubes/Linux recently and don't really know my way around. I'm coming from Windows/OSX. I hope this isn't a deal breaker for you.


Sent from ProtonMail mobile

[dhorf-hfre...@hashmail.org]

On Wed, Feb 26, 2020 at 03:47:34PM +0000, 'Yiyi50' via qubes-users wrote:
> If you download a new TemplateVM inside an existing Qubes system,
> using "sudo qubes-dom0-update qubes-template-debian-xx" does that
> download have a signature file that needs to be verified with the
> Qubes Master Signing key? And if yes, how do I do that? If the Master
> Signing Key isn't in Dom0, but the mirror image is downloaded within
> Dom0, how can I verify it?

there should be no need for manual verification.
all qubes rpm pkgs should be signed and checked.
the usual "how to check/verify an rpm signature" should apply
if you really want to check "by hand".