Git-Mirrors/qubes-doc
1
0
Fork 0
mirror of https://github.com/QubesOS/qubes-doc.git synced 2024-09-20 08:05:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix code blocks and escapes

Browse Source
This commit is contained in:
Axon 2015-09-22 18:13:23 +00:00
parent d52ca1538b
commit 6f90c5ef19
No known key found for this signature in database
GPG Key ID: 8CE137352A019A17
1 changed files with 74 additions and 91 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

165
VerifyingSignatures.md
View File

@ -28,120 +28,105 @@ However, for digital signatures to make any sense, we must ensure that the publi
Importing Qubes Signing Keys Importing Qubes Signing Keys
---------------------------- ----------------------------
Every file published by the Qubes Project (ISO, RPM, TGZ files and git repositories) is digitally signed by one of the developer or release signing keys. Each such key is signed by the Qubes Master Signing Key ([\`0x36879494\`](https://keys.qubes-os.org/keys/qubes-master-signing-key.asc)). Every file published by the Qubes Project (ISO, RPM, TGZ files and git repositories) is digitally signed by one of the developer or release signing keys. Each such key is signed by the Qubes Master Signing Key ([`0x36879494`](https://keys.qubes-os.org/keys/qubes-master-signing-key.asc)).
The public portion of the Qubes Master Signing Key can be imported directly from a [ keyserver](https://en.wikipedia.org/wiki/Key_server_%28cryptographic%29#Keyserver_examples) (specified on first use with --keyserver URI, keyserver saved in \~/.gnupg/gpg.conf), e.g., The public portion of the Qubes Master Signing Key can be imported directly from a [ keyserver](https://en.wikipedia.org/wiki/Key_server_%28cryptographic%29#Keyserver_examples) (specified on first use with --keyserver URI, keyserver saved in `~/.gnupg/gpg.conf`), e.g.,
``` gpg --keyserver pool.sks-keyservers.net --recv-keys 0x427F11FD0FAA4B080123F01CDDFA1A3E36879494
gpg --keyserver pool.sks-keyservers.net --recv-keys 0x427F11FD0FAA4B080123F01CDDFA1A3E36879494
```
or downloaded [here](https://keys.qubes-os.org/keys/qubes-master-signing-key.asc) and imported with gpg, or downloaded [here](https://keys.qubes-os.org/keys/qubes-master-signing-key.asc) and imported with gpg,
``` $ gpg --import ./qubes-master-signing-key.asc
$ gpg --import ./qubes-master-signing-key.asc
```
or fetched directly with gpg. or fetched directly with gpg.
``` $ gpg --fetch-keys https://keys.qubes-os.org/keys/qubes-master-signing-key.asc
$ gpg --fetch-keys https://keys.qubes-os.org/keys/qubes-master-signing-key.asc
```
For additional security we also publish the fingerprint of the Qubes Master Signing Key ([\`0x36879494\`](https://keys.qubes-os.org/keys/qubes-master-signing-key.asc)) here in this document: For additional security we also publish the fingerprint of the Qubes Master Signing Key ([`0x36879494`](https://keys.qubes-os.org/keys/qubes-master-signing-key.asc)) here in this document:
``` pub 4096R/36879494 2010-04-01
pub 4096R/36879494 2010-04-01 Key fingerprint = 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494
Key fingerprint = 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494 uid Qubes Master Signing Key
uid Qubes Master Signing Key
```
There should also be a copy of this key at the project's main website, in the [Qubes Security Pack](/doc/SecurityPack/), and in the archives of the project's [developer](https://groups.google.com/forum/#!msg/qubes-devel/RqR9WPxICwg/kaQwknZPDHkJ) and [user](https://groups.google.com/d/msg/qubes-users/CLnB5uFu_YQ/ZjObBpz0S9UJ) mailing lists. There should also be a copy of this key at the project's main website, in the [Qubes Security Pack](/doc/SecurityPack/), and in the archives of the project's [developer](https://groups.google.com/forum/#!msg/qubes-devel/RqR9WPxICwg/kaQwknZPDHkJ) and [user](https://groups.google.com/d/msg/qubes-users/CLnB5uFu_YQ/ZjObBpz0S9UJ) mailing lists.
Once you have obtained the Qubes Master Signing Key ([\`0x36879494\`](https://keys.qubes-os.org/keys/qubes-master-signing-key.asc)), you should verify the fingerprint of this key very carefully by obtaining copies of the fingerprint from trustworthy independent sources and comparing them to the downloaded key's fingerprint to ensure they match. Then set its trust level to "ultimate" (oh, well), so that it can be used to automatically verify all the keys signed by the Qubes Master Signing Key: Once you have obtained the Qubes Master Signing Key ([`0x36879494`](https://keys.qubes-os.org/keys/qubes-master-signing-key.asc)), you should verify the fingerprint of this key very carefully by obtaining copies of the fingerprint from trustworthy independent sources and comparing them to the downloaded key's fingerprint to ensure they match. Then set its trust level to "ultimate" (oh, well), so that it can be used to automatically verify all the keys signed by the Qubes Master Signing Key:
```
$ gpg --edit-key 0x36879494
gpg (GnuPG) 1.4.18; Copyright (C) 2014 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
pub 4096R/36879494 created: 2010-04-01 expires: never usage: SC $ gpg --edit-key 0x36879494
trust: unknown validity: unknown gpg (GnuPG) 1.4.18; Copyright (C) 2014 Free Software Foundation, Inc.
[ unknown] (1). Qubes Master Signing Key This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
gpg> fpr
pub 4096R/36879494 2010-04-01 Qubes Master Signing Key
Primary key fingerprint: 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494 pub 4096R/36879494 created: 2010-04-01 expires: never usage: SC
trust: unknown validity: unknown
gpg> trust [ unknown] (1). Qubes Master Signing Key
pub 4096R/36879494 created: 2010-04-01 expires: never usage: SC
trust: unknown validity: unknown gpg> fpr
[ unknown] (1). Qubes Master Signing Key pub 4096R/36879494 2010-04-01 Qubes Master Signing Key
Primary key fingerprint: 427F 11FD 0FAA 4B08 0123 F01C DDFA 1A3E 3687 9494
Please decide how far you trust this user to correctly verify other users' keys
(by looking at passports, checking fingerprints from different sources, etc.) gpg> trust
pub 4096R/36879494 created: 2010-04-01 expires: never usage: SC
1 = I don't know or won't say trust: unknown validity: unknown
2 = I do NOT trust [ unknown] (1). Qubes Master Signing Key
3 = I trust marginally
4 = I trust fully Please decide how far you trust this user to correctly verify other users' keys
5 = I trust ultimately (by looking at passports, checking fingerprints from different sources, etc.)
m = back to the main menu
1 = I don't know or won't say
Your decision? 5 2 = I do NOT trust
Do you really want to set this key to ultimate trust? (y/N) y 3 = I trust marginally
4 = I trust fully
pub 4096R/36879494 created: 2010-04-01 expires: never usage: SC 5 = I trust ultimately
trust: ultimate validity: unknown m = back to the main menu
[ unknown] (1). Qubes Master Signing Key
Please note that the shown key validity is not necessarily correct Your decision? 5
unless you restart the program. Do you really want to set this key to ultimate trust? (y/N) y
gpg> q pub 4096R/36879494 created: 2010-04-01 expires: never usage: SC
``` trust: ultimate validity: unknown
[ unknown] (1). Qubes Master Signing Key
Please note that the shown key validity is not necessarily correct
unless you restart the program.
gpg> q
Now you can easily download any of the developer or release signing keys that happen to be used to sign particular ISO, RPM, TGZ files or git tags. Now you can easily download any of the developer or release signing keys that happen to be used to sign particular ISO, RPM, TGZ files or git tags.
For example: Qubes OS Release 2 Signing Key ([\`0x0A40E458\`](https://keys.qubes-os.org/keys/qubes-release-2-signing-key.asc)) is used for all Release 2 ISO images. For example: Qubes OS Release 2 Signing Key ([`0x0A40E458`](https://keys.qubes-os.org/keys/qubes-release-2-signing-key.asc)) is used for all Release 2 ISO images.
``` $ gpg --recv-keys 0x3F01DEF49719158EF86266F80C73B9D40A40E458
$ gpg --recv-keys 0x3F01DEF49719158EF86266F80C73B9D40A40E458 gpg: requesting key 0A40E458 from hkp server keys.gnupg.net
gpg: requesting key 0A40E458 from hkp server keys.gnupg.net gpg: key 0A40E458: public key "Qubes OS Release 2 Signing Key" imported
gpg: key 0A40E458: public key "Qubes OS Release 2 Signing Key" imported gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model gpg: depth: 0 valid: 1 signed: 1 trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: depth: 0 valid: 1 signed: 1 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: depth: 1 valid: 1 signed: 0 trust: 1-, 0q, 0n, 0m, 0f, 0u
gpg: depth: 1 valid: 1 signed: 0 trust: 1-, 0q, 0n, 0m, 0f, 0u gpg: Total number processed: 1
gpg: Total number processed: 1 gpg: imported: 1 (RSA: 1)
gpg: imported: 1 (RSA: 1)
```
You can also download all the currently used developers' signing keys and current and older release signing keys (and also a copy of the Qubes Master Signing Key) from the [keys directory on our server](https://keys.qubes-os.org/keys/) and from the [Qubes Security Pack](/doc/SecurityPack/). You can also download all the currently used developers' signing keys and current and older release signing keys (and also a copy of the Qubes Master Signing Key) from the [keys directory on our server](https://keys.qubes-os.org/keys/) and from the [Qubes Security Pack](/doc/SecurityPack/).
The developer signing keys are set to be valid for 1 year only, while the Qubes Master Signing Key ([\`0x36879494\`](https://keys.qubes-os.org/keys/qubes-master-signing-key.asc)) has no expiration date. This latter key was generated and is kept only within a dedicated, air-gapped "vault" machine, and the private portion will (hopefully) never leave this isolated machine. The developer signing keys are set to be valid for 1 year only, while the Qubes Master Signing Key ([`0x36879494`](https://keys.qubes-os.org/keys/qubes-master-signing-key.asc)) has no expiration date. This latter key was generated and is kept only within a dedicated, air-gapped "vault" machine, and the private portion will (hopefully) never leave this isolated machine.
You can now verify the ISO image (Qubes-R2-x86\_64-DVD.iso) matches its signature (Qubes-R2-x86\_64-DVD.iso.asc): You can now verify the ISO image (`Qubes-R2-x86_64-DVD.iso`) matches its signature (`Qubes-R2-x86_64-DVD.iso.asc`):
``` $ gpg -v --verify Qubes-R2-x86_64-DVD.iso.asc
$ gpg -v --verify Qubes-R2-x86_64-DVD.iso.asc gpg: armor header: Version: GnuPG v1
gpg: armor header: Version: GnuPG v1 gpg: assuming signed data in `Qubes-R2-x86_64-DVD.iso'
gpg: assuming signed data in `Qubes-R2-x86_64-DVD.iso' gpg: Signature made Tue Sep 23 08:38:40 2014 UTC using RSA key ID 0A40E458
gpg: Signature made Tue Sep 23 08:38:40 2014 UTC using RSA key ID 0A40E458 gpg: using PGP trust model
gpg: using PGP trust model gpg: Good signature from "Qubes OS Release 2 Signing Key"
gpg: Good signature from "Qubes OS Release 2 Signing Key" gpg: binary signature, digest algorithm SHA1
gpg: binary signature, digest algorithm SHA1
```
The Release 2 Signing Key ([\`0x0A40E458\`](https://keys.qubes-os.org/keys/qubes-release-2-signing-key.asc)) used to sign this ISO image should be signed by the Qubes Master Signing Key ([\`0x36879494\`](https://keys.qubes-os.org/keys/qubes-master-signing-key.asc)): The Release 2 Signing Key ([`0x0A40E458`](https://keys.qubes-os.org/keys/qubes-release-2-signing-key.asc)) used to sign this ISO image should be signed by the Qubes Master Signing Key ([`0x36879494`](https://keys.qubes-os.org/keys/qubes-master-signing-key.asc)):
``` $ gpg --list-sig 0A40E458
$ gpg --list-sig 0A40E458 pub 4096R/0A40E458 2012-11-15
pub 4096R/0A40E458 2012-11-15 uid Qubes OS Release 2 Signing Key
uid Qubes OS Release 2 Signing Key sig 36879494 2012-11-15 Qubes Master Signing Key
sig 36879494 2012-11-15 Qubes Master Signing Key sig 3 0A40E458 2012-11-15 Qubes OS Release 2 Signing Key
sig 3 0A40E458 2012-11-15 Qubes OS Release 2 Signing Key
```
Having problems verifying the ISO images? Make sure you have the corresponding release signing key and see this thread: Having problems verifying the ISO images? Make sure you have the corresponding release signing key and see this thread:
@ -154,6 +139,4 @@ Developers who fetch code from our Git server should always verify tags on the l
To verify a signature on a git tag, you can use: To verify a signature on a git tag, you can use:
``` $ git tag -v <tag name>
$ git tag -v <tag name>
```