1

I am running Devuan Jessie. I want to install another Devuan Ascii from scratch. So I downloaded:

But I found no way to authenticate devuan-devs.gpg.

Other distros like Debian or Ubuntu or similar allow me to verify the ISO from an existing previous version.

But for Devuan, I did not find any way:

tino@ts:~/ISO/devuan_ascii-2.0.0$ gpg --verify SHA256SUMS.asc
gpg: assuming signed data in `SHA256SUMS'
gpg: Signature made Wed 06 Jun 2018 08:55:55 PM CEST using DSA key ID 0B5F062F
gpg: Can't check signature: public key not found
tino@ts:~/ISO/devuan_ascii-2.0.0$ gpg --no-default-keyring --keyring /usr/share/keyrings/devuan-archive-keyring.gpg --verify SHA256SUMS.asc
gpg: assuming signed data in `SHA256SUMS'
gpg: Signature made Wed 06 Jun 2018 08:55:55 PM CEST using DSA key ID 0B5F062F
gpg: Can't check signature: public key not found
tino@ts:~/ISO/devuan_ascii-2.0.0$ gpg --no-default-keyring --keyring /usr/share/keyrings/devuan-keyring.gpg --verify SHA256SUMS.asc
gpg: assuming signed data in `SHA256SUMS'
gpg: Signature made Wed 06 Jun 2018 08:55:55 PM CEST using DSA key ID 0B5F062F
gpg: Can't check signature: public key not found

tino@ts:~/ISO/devuan_ascii-2.0.0$ gpg --keyring ../devuan-devs.gpg --verify SHA256SUMS.asc
gpg: assuming signed data in `SHA256SUMS'
gpg: Signature made Wed 06 Jun 2018 08:55:55 PM CEST using DSA key ID 0B5F062F
gpg: Good signature from "Vincenzo (KatolaZ) Nicosia <katolaz@freaknet.org>"
gpg:                 aka "Vincenzo Nicosia (KatolaZ) <me@katolaz.homeunix.net>"
gpg:                 aka "Vincenzo Nicosia (KatolaZ) <katolaz@yahoo.it>"
gpg:                 aka "KatolaZ <katolaz@freaknet.org>"
gpg:                 aka "Enzo Nicosia <katolaz@freaknet.org>"
gpg:                 aka "Enzo Nicosia -- KatolaZ <katolaz@freaknet.org>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 8E59 D6AA 445E FDB4 A153  3D5A 5F20 B3AE 0B5F 062F

As the "key is not certified", there is no indication that the key is not fake. How can this broken trust chain be fixed?

https://devuan.org/os/documentation/dev1fanboy/general-information does not solve this riddle either.

Notes:

devuan-devs.gpg probably is not fake. However this assumption does not help. There must be some way to ensure, it is not fake. The initial Hen-Egg problem is already solved, as Devuan (Jessie) already runs at my side.

There certainly is some better way to authenticate Ascii's ISO than to upgrade Jessie to Ascii. Right?

  • Have a look at Antix, it is so much better. – Rui F Ribeiro Aug 30 '18 at 16:04
  • @RuiFRibeiro It's now the 3rd millennium and Cryptography still is far too complex to be used properly, even by pros! That's important, on a planetary level! So please do not start unimportant religious wars like which Distro or Init is better. Thanks ;) – Tino Sep 2 '18 at 16:40
  • Are you so quick dismissing what people tell you without checking out facts...Antix is what Devuan should have been. – Rui F Ribeiro Sep 2 '18 at 21:06
  • @RuiFRibeiro Actually I checked and Antix does not verify files.devuan.org/devuan-devs.gpg either. So please calm down! – Tino Sep 6 '18 at 9:55
0

Unfortunately, there doesn’t appear to be a better way to authenticate the images:

  • all the files involved are downloaded over the same channel;
  • the key used to sign the SHA256SUMS file isn’t available in the previous Devuan release;
  • the key, as provided in the keyring, isn’t signed by any other key;
  • the key, as published to keyservers, is signed, but it isn’t in the strong set, and none of the signatures come from keys which are in the previous Devuan release’s keyring.

The fact that the same key is available from the keyservers and in the published keyring might be construed as providing more guarantees, but I’m not sure it does since we still don’t know that the owner is a legitimate Devuan release signer.

  • Thanks for your observation about the keyservers. I do not trust keyservers, so I forgot about them, as usual. – Tino Sep 2 '18 at 16:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.