Arch Linux

Kasumi_Ninja

Member

Registered: 2009-12-31

Posts: 54

Which key-id do I need to import to verify the installtion image?

In the beginners guide the following steps are listed to verify the installation image:

gpg --recv-keys key-id.
gpg --verify archlinux-version-dual.iso.sig

Which key-id do I need to import? Similar instructions for Fedora list an url: https://getfedora.org/en/verify

Raynman

Member

Registered: 2011-10-22

Posts: 1,539

Re: Which key-id do I need to import to verify the installtion image?

In the beginners guide the following steps are listed to verify the installation image:

Yes, but they are not listed like that. It says to run --verify and then, if the key is not found, to import it. gpg should tell you which key it cannot find.

Kasumi_Ninja

Member

Registered: 2009-12-31

Posts: 54

Re: Which key-id do I need to import to verify the installtion image?

To summarize:

1 $ gpg --verify archlinux-2015.05.01-dual.iso.sig

gpg: assuming signed data in 'archlinux-2015.05.01-dual.iso'
gpg: Signature made Fri 01 May 2015 07:38:20 AM CEST using RSA key ID 9741E8AC
gpg: Can't check signature: No public key

2 Check if RSA key ID 9741E8AC matches with https://www.archlinux.org/master-keys/. In this case it maches with Pierre Schmitz key.
3 If it matches, issue a $ gpg --recv-keys 9741E8AC

Is that correct?

Last edited by Kasumi_Ninja (2015-05-21 12:41:36)

karol

Archivist

Registered: 2009-05-06

Posts: 25,440

Re: Which key-id do I need to import to verify the installtion image?

I've edited the guide so that the 'version' part is not taken literally: https://wiki.archlinux.org/index.php?title=Beginners'_guide&diff=374426&oldid=373876