• lemmyreaderOP
    link
    fedilink
    English
    arrow-up
    2
    ·
    6 months ago

    How does making a keyring file work ? I tried it by importing the signing key into my keyring and then ran gpgv tails-amd64-6.4.img.sig tails-amd64-6.4.img which also gives : gpgv: Can't check signature: No public key

    Found this, which appears to suggest to use other verification methods : https://tails.net/contribute/design/download_verification/#index2h1

    OpenPGP verification instructions

    We removed the instructions to verify downloads with OpenPGP because:

    Without advanced knowledge of OpenPGP, verifying with OpenPGP provides the same level of security as the JavaScript verification on the download page, while being much more complicated and error-prone.

    None of our personas would have enough knowledge of OpenPGP to use the OpenPGP Web of Trust with confidence.

    Providing basic (and never exhaustive) instructions has proven to be very time consuming to our help desk and technical writers. See #17900.

    We still explain how to verify our signing key using the OpenPGP Web of Trust in the installation instructions from Debian, Ubuntu, or Mint using the command line and GnuPG because Debian derivatives come with trusted OpenPGP keys that can be used to create a path to our signing key.