How to trust key and validate it?

General system EndeavourOS installation
1

Hi, I am brand new to EndeavourOS and fairly new to Linux in general and not an IT person by any means :slight_smile:

I am following the instructions at:
https://endeavouros.com/#sha512sum-check

It says to:

To check the ISO file with GPG signature, import our key and verify

(Do not forget to trust the key after validating it)

This ISO is signed by: Johannes Kamprad (joekamprad@endeavouros.com)

Primary key fingerprint: 8F43 FC37 4CD4 CEEA 19CE E323 E3D8 752A CDF5 95A1

To verify the key:

fetch the key and verify the ISO with the signature file:

gpg --recv CDF595A1gpg --verify EndeavourOS_Endeavour_neo-2024.09.22.iso.sig

I have been able to figure out how to do all the steps above except for:

(Do not forget to trust the key after validating it)

I went to the linked page and the content is just too above my head to understand it.

I have searched the EndeavourOS forums for “trust key” and did not find anything.

Could I please have some help to figure out how to do this step?

How do I trust the key?

How do I validate it?

Is validating the key the same as verifying it?

Is validating the key the same as:

To verify the key:

fetch the key and verify the ISO with the signature file:

gpg --recv CDF595A1gpg --verify EndeavourOS_Endeavour_neo-2024.09.22.iso.sig

Any help is much appreciated.

2

Hi

Place the ISO file and SIG file in the same directory and run:

gpg --recv CDF595A1

To trust the key, run gpg --edit-key CDF595A1 and in the prompt then generated, enter trust. Enter a number for trust and then enter save.

To verify the ISO itself, run

gpg --verify EndeavourOS_Endeavour_neo-2024.09.22.iso.sig

This should output something like Good signature from "Johannes Kamprad (joekamprad development key) <joekamprad@endeavouros.com>"

4 Likes
3

Great, i didn’t know this either.

@joekamprad
Can this be added to the wiki page?

1 Like
4

Actually that info is already at https://endeavouros.com/, soon after the download links.

1 Like
5

Yes i am aware of that but just like the OP it was unclear/overwhelming to me how to trust the gpg key.
@flyingcakes explained that in a very understandable way, so that part is nice to have on the download page?

1 Like
6

@flyingcakes - Thanks very much for your quick and very helpful response. I will try this soon when I have the time.

1 Like
7

I agree @flyingcakes explained it in a clear and understandable way, and thus it would fit well on the download page.
Let’s see how busy @joekamprad is and what he feels about it.

2 Likes
8

Practically speaking, it shouldn’t matter if the key is trusted or not.

After manually setting trust level to 2, i.e. I do NOT trust, I get this output.

gpg: assuming signed data in 'EndeavourOS_Endeavour_neo-2024.09.22.iso'
gpg: Signature made Sun 22 Sep 2024 04:33:38 PM IST
gpg:                using RSA key 8F43FC374CD4CEEA19CEE323E3D8752ACDF595A1
gpg: checking the trustdb
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   2  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 2u
gpg: Good signature from "Johannes Kamprad (joekamprad development key) <joekamprad@endeavouros.com>" [unknown]
gpg:                 aka "[jpeg image of size 3520]" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 8F43 FC37 4CD4 CEEA 19CE  E323 E3D8 752A CDF5 95A1

It warns about key not being trusted. Nonetheless, it gives us the info we need: ISO has a “good signature”.

Since its Joe’s signature (whom I trust!), I keep trust level to 5, i.e. I trust ultimately :smile:

But the trusting process not being on website doesn’t hamper the process of verifying the ISO itself. Yes, its confusing because gpg warns about signature.

9

@flyingcakes - Thanks also explaining about which trust level I should choose :slight_smile:

10

@manuel and @joekamprad - I would be happy to write up a draft step by step procedure if that would help for putting on the downloads page.

1 Like
11

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.

12

Danke sehr :wink:

1 Like
13

The page have a link to the official tutorial already:
https://www.gnupg.org/gph/en/manual/x334.html

Adding detailed tutorial on the main website is not to my liking.

We can link to a wiki with exact detailed article.
This can be added to the discovery wiki.
I will be happy to add when you send it to me here or in P.M. or mail…

For now adding a bit more details:

2025-01-01_19-57
2025-01-01_19-57686Ă—486 39.2 KB

https://endeavouros.com/#sha512sum-check

14

https://discovery.endeavouros.com/installation/how-to-check-and-trust-key-and-signature-for-the-endeavouros-iso/2025/01/

Thanks at
@fred666 and @flyingcakes

1 Like