{{Header}} {{Title|title= Download the {{project_name_short}} Signing Key for VirtualBox, Source Code and APT Repository }} {{#seo: |description=Get {{project_name_short}} VirtualBox, Source Code and APT Repository OpenPGP signing key. Verify {{project_name_short}} VirtualBox Downloads, APT Repository and/or Source Code. |image=Keysigning.jpg }}

* [[Main/Project Signing Key|{{project_name_short}} Main, VirtualBox, APT Repository and Source Code Signing Key]] * [[KVM/Project Signing Key|{{project_name_short}} KVM Signing Key]]

[[image:Keysigning.jpg|thumb]] {{intro| Get {{project_name_short}} VirtualBox, Source Code and APT Repository OpenPGP signing key. Verify {{project_name_short}} VirtualBox Downloads, APT Repository and/or Source Code. }} = Introduction = Since all {{project_name_short}} VirtualBox releases are signed with the same key, it is unnecessary to verify the key every time a new release is announced. Trust in the key might gradually increase over time, but cryptographic signatures must still be verified every time a new release is downloaded. This page is strongly related to the [[Trust|Placing Trust in {{project_name_short}}]] page. {{always_verify_signatures_reminder}} {{Anchor|Download the Key}} = Download the OpenPGP Key = [[File:GnuPG-Logo.svg|thumb|100px|GnuPG logo]] {{Box|text= {{gpg_init}} }} {{Box|text= Select your operating system. {{Tab |type=controller |content= {{Tab|active=true |title= == Windows, macOS, Linux == |image=[[File:Any12312.png|25px]] |content= '''1.''' [[Secure_Downloads|Securely]] download [[Patrick Schleizer]]'s (adrelanos') [[OpenPGP]] key. {{CodeSelect|code= curl --tlsv1.3 --proto =https --max-time 180 --output derivative.asc https://www.{{project_clearnet}}/keys/derivative.asc }} * https://www.{{project_clearnet}}/keys/derivative.asc * https://github.com/Whonix/qubes-template-whonix/blob/master/keys/whonix-developer-patrick.asc * https://github.com/QubesOS/qubes-builder/blob/master/keys/916B8D99C38EAF5E8ADC7A2A8D66066A2EEACCDA.asc {{signing_key_main}} '''2.''' Store the key as derivative.asc. '''3.''' Check fingerprints/owners without importing anything. {{CodeSelect|code= gpg --keyid-format long --import --import-options show-only --with-fingerprint derivative.asc }} '''4.''' Verify the output. The most important check is confirming the key fingerprint exactly matches the output below. Minor changes in the output such as new uids (email addresses) or newer expiration dates are inconsequential.

      Key fingerprint = 916B 8D99 C38E AF5E 8ADC  7A2A 8D66 066A 2EEA CCDA

The message gpg: key 8D66066A2EEACCDA: 104 signatures not checked due to missing keys is related to the [[OpenPGP#The_OpenPGP_Web_of_Trust|The OpenPGP Web of Trust]]. Advanced users can learn more about this [[#OpenPGP Web of Trust|below]]. {{mbox | image = [[File:Ambox_warning_pn.svg.png|warning|40px]] | text = '''Warning:''' Do not continue if the fingerprint does not match! This risks using infected or erroneous files! The whole point of verification is to confirm file integrity. }} '''5.''' Import the key. {{CodeSelect|code= gpg --import derivative.asc }} The output should include the key was imported.

gpg: Total number processed: 1
gpg:               imported: 1

''If the {{project_name_short}} signing key was already imported in the past'', the output should include the key is unchanged.

gpg: Total number processed: 1
gpg:              unchanged: 1

If the following message appears at the end of the output.

gpg: no ultimately trusted keys found

This extra message does not relate to the {{project_name_short}} signing key itself, but instead usually means the user has not created an OpenPGP key yet, which is of no importance when verifying virtual machine images. Analyze the other messages as usual. '''6.''' Web of trust. Advanced users can check [[#Web of Trust|Web of Trust]] further below for better security. }} {{Tab |title= == Kicksecure or Whonix == |image=[[File:Kicksecure-icon-logo.svg|25px]] |content= '''1.''' Import the key. Since the key is already available in Kicksecure or Whonix, importing the key is simpler than for other operating systems. {{CodeSelect|code= gpg --import /usr/share/keyrings/derivative.asc }} The message gpg: key 8D66066A2EEACCDA: 104 signatures not checked due to missing keys is related to the [[OpenPGP#The_OpenPGP_Web_of_Trust|The OpenPGP Web of Trust]]. Advanced users can learn more about this [[#OpenPGP Web of Trust|below]]. '''2.''' Skip a few steps. Steps '''2.''' to '''6.''' (which would be required for Windows, macOS and other Linux) can be skipped here. Proceed to step '''7.''' below. }} {{Tab |title= == Debian and Derivatives == |image=[[File:Debian.png|25px]] |content= '''1.''' Install extrepo-offline-data. Because it contains the signing key. {{Install Package|package= extrepo-offline-data }} '''2.''' Import the key. Thanks to the extrepo-offline-data package, the key is already available on the local file system and can be imported into the user's keyring. Note to wiki editors: * Hardcoded to whonix.asc. * This is because at the time kicksecure.asc was not yet included in package extrepo-offline-data. * https://packages.debian.org/bullseye-backports/all/extrepo-offline-data/filelist {{CodeSelect|code= gpg --import /usr/share/extrepo/offline-data/debian/bullseye/whonix.asc }} '''3.''' Skip a few steps. Proceed to step '''7.''' below. }} }} '''7.''' Complete the {{project_name_short}} verification steps. If verifying {{project_name_short}} images, navigate to the relevant verification page below to finish the process: * [[File:Tux.png|15px|link=]] [[Verify the_virtual_machine_images_using_the_command line|In Linux]] * [[File:Logo-windows-500x500.png|15px|link=]] [[Verify_the_images_using_Windows|In Windows]] * [[File:logo-apple-500x500.png|15px]] [[Verify_the_images_using_macOS|In macOS]] }} = OpenPGP Key Features = * sign/verify {{project_name_short}} VirtualBox images: yes * sending encrypted e-mails to {{project_name_short}} developer Patrick: yes = Advanced Users = {{Anchor|Web of Trust}} == OpenPGP Web of Trust == A few people have signed [[Patrick Schleizer]]'s (adrelanos') OpenPGP key in [[OpenPGP#The_OpenPGP_Web_of_Trust|The OpenPGP Web of Trust]]. Jan Dittberner https://jan.dittberner.info/ ({{Code2|Debian Developer}}) https://qa.debian.org/developer.php?login=Jan+Dittberner signed Patrick's key. So did intrigeri (Tails developer, {{Code2|Debian Developer}}); Peter Palfrader ({{Code2|Debian Developer}}); Richard King; and Michael Carbone (accessnow.org). Users relying on Debian or one of the many Debian derivatives (like Ubuntu) already trust apt, the APT repository of the relevant distribution. This means the Debian keyring can be installed as a trusted source for obtaining Jan's, intrigeri's or Peter's key, to check their signature on Patrick's key. {{Box|text= '''1.''' [[Update]] the package lists. {{CodeSelect|code= sudo apt update }} '''2.''' Install the Debian keyring. {{CodeSelect|code= sudo apt install debian-keyring }} '''3.''' Extract a signer's key from the Debian keyring and import it into your own keyring. Here is an example using Jan's key. {{CodeSelect|code= gpg --no-default-keyring --keyring /usr/share/keyrings/debian-keyring.gpg --armor --export B2FF1D95CE8F7A22DF4CF09BA73E0055558FB8DD {{!}} gpg --import }} '''4.''' ''Optional:'' Try to establish a better trust path to the signer by checking signatures on the signer's key. Check signatures on Patrick's key. {{CodeSelect|code= gpg --check-sigs 916B8D99C38EAF5E8ADC7A2A8D66066A2EEACCDA }} The output of the above command should show signatures on Patrick's key, which should include the signer's signature. }} == Download the signify Key == [[File:Signify_Logo.svg|thumb|100px|signify]] {{mbox | type = notice | image = [[File:Ambox_notice.png|40px|alt=Info]] | text = Advanced users only! }}

{{signing_key_main_signify}} = Further Reading = * [https://en.wikipedia.org/wiki/GNU_Privacy_Guard GnuPG wikipedia] - free OpenPGP software. * [https://www.apache.org/dev/openpgp.html Apache: How To OpenPGP]. * [https://www.debian.org/events/keysigning Debian: Keysigning] - a tutorial on signing keys of other people. * [https://www.rubin.ch/pgp/weboftrust.en.html rubin.ch: An explanation of the PGP web of trust]. {{Template:GnuPG-Troubleshooting}} = See Also = * [[Verify the images|Verify {{project_name_short}} Images]] * [[Verifying Software Signatures]] * [[Trust|Placing Trust in {{project_name_short}}]] * [[OpenPGP|OpenPGP key distribution strategies]] = License = {{License_Amnesia|{{FULLPAGENAME}}}} = Footnotes = {{reflist|close=1}} {{Footer}} [[Category:Documentation]] [[Category:MultiWiki]]