Arch Linux

giraffeisthier

Member

Registered: 2020-05-21

Posts: 6

[SOLVED] Verify Archlinux Installation ISO Signature

I'm just trying to verify the signature of the installation iso as per the installation guide using

$ gpg --keyserver-options auto-key-retrieve --verify archlinux-2020.05.01-x86_64.iso.sig

and get back

gpg: assuming signed data in 'archlinux-2020.05.01-x86_64.iso'
gpg: Signature made Thu 30 Apr 2020 11:33:57 PM MDT
gpg:                using RSA key 4AA4767BBC9C4B1D18AE28B77F2D434B9741E8AC
gpg: key 7F2D434B9741E8AC: new key but contains no user ID - skipped
gpg: Total number processed: 1
gpg:           w/o user IDs: 1
gpg: Can't check signature: No public key

Completely new to gpg, so I have no idea how to debug this, and couldn't find much by searching google or the forums. Any advice/help is appreciated. Thanks!

Last edited by giraffeisthier (2020-05-21 19:48:55)

loqs

Member

Registered: 2014-03-06

Posts: 17,327

Re: [SOLVED] Verify Archlinux Installation ISO Signature

The keyserver returning the key did not include the user ID so it could not be used to verify the signature.  You could change the keyserver or alternately use WKD

gpg --locate-keys pierre@archlinux.de

Should produce output such as the following which is from the April ISO

gpg --keyserver-options auto-key-retrieve --verify archlinux-2020.04.01-x86_64.iso.sig
gpg: assuming signed data in 'archlinux-2020.04.01-x86_64.iso'
gpg: Signature made Wed Apr  1 03:38:31 2020 UTC
gpg:                using RSA key 4AA4767BBC9C4B1D18AE28B77F2D434B9741E8AC
gpg: Good signature from "Pierre Schmitz <pierre@archlinux.de>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 4AA4 767B BC9C 4B1D 18AE  28B7 7F2D 434B 9741 E8AC

The fingerprint above matches https://git.archlinux.org/archlinux-key … pierre.asc / https://www.archlinux.org/master-keys/

Last edited by loqs (2020-05-21 19:33:43)

giraffeisthier

Member

Registered: 2020-05-21

Posts: 6

Re: [SOLVED] Verify Archlinux Installation ISO Signature

Works great! Thanks!