5 ms·
Don't forget to verify the install medium, which is a little more involved with Debian. If you're already running a trusted Debian system, then install the deb
by RJIb8RBYxzAMX9u 9y ago
Don't forget to verify the install medium, which is a little more involved with Debian.
If you're already running a trusted Debian system, then install the debian-keyring package. Packages are signed and verified, so those keys don't need further verification.
Otherwise, fetch the keys in [0] with gpg:
$ gpg --keyserver keyring.debian.org --recv-keys <...> # e.g. 0x6294BE9B
Then, verify the key's fingerprint with [0]:
$ gpg --fingerprint
Unless you don't trust your CA, this is good enough.
Finally download the checksum and their signature files, and verify their signatures:
$ gpg --verify <...> # e.g. SHA512SUMS.sign
$ gpg --no-default-keyring --keyring /usr/share/keyrings/debian-role-keys.gpg --verify <...> # if using debian-keyring package
[0] https://www.debian.org/CD/verify https://www.debian.org/CD/verify
- jbverschoor 9y agoIt's not working for me.. # gpg --keyserver keyring.debian.org --recv-keys EF0F382A1A7B6500 gpg: requesting key 1A7B6500 from hkp server keyring.debian.org gpgkeys: key EF0F382A1A7B6500 can't be retrieved gpg: no valid OpenPGP data found.
- RJIb8RBYxzAMX9u 9y agoWhere are you getting "EF0F382A1A7B6500" from? The short key ids on the page, at least for me, are: 64E6EA7D 6294BE9B 09EA8AC3
- jbverschoor 9y ago# apt-get update ......... Reading package lists... Done W: There is no public key available for the following key IDs: EF0F382A1A7B6500
- jbverschoor 9y agoapt-get install debian-archive-keyring seems to do the trick
- deleted 9y ago[deleted]
- deleted 9y ago[deleted]
- JdeBP 9y agoSee Debian Bug #860831.
- tlikonen 9y agoWith files SHA512SUMS and SHA512SUMS.sign in the current directory the verifying can be as simple as gpg --auto-key-retrieve SHA512SUMS.sign The key is retrieved from user's default keyring or keyservers. The usual keyserver pool (pool.sks-keyservers.net) has the Debian CD signing key. How we can trust that the key is the right one is another matter. It is signed by many Debian developers.
- RJIb8RBYxzAMX9u 9y agoRight, if you're already in the WOT then there are better ways, but then you're probably familiar enough with GPG that you don't need any help. :-) Most distributions have signed checksum files, but also post those checksums in a HTTPS location. I, and I suspect most people, just check against that and call it good. AFAIK Debian don't have that, and between using GPG or thinking "F* it, I'll take my chances", I suspect many would choose the latter. I was trying to give people who's security conscious but not paranoid^W^Wlazy an option.
- jwilk 9y agoSadly, the verification procedure is so complicated, most people won't bother, and most of the remaining people will do it wrong.
- AaaaBbbbasas 9y agoDon't forget Ian, stupids.