Re: Causing segmentations fault; Was: Re: No Public Key

2022-11-14 Thread Greg Wooledge
On Mon, Nov 14, 2022 at 08:44:54PM -, Curt wrote:
> On 2022-11-14,   wrote:
> >
> >> https://gitlab.com/muttmua/mutt/-/issues/428
> >
> > Is there a non-javascript-ey way to look at those issues?
> >
> 
> 
> Mutt crashes with SIGSEGV when uid -variable is NULL in 
> pgp_gpgme_extrace_keys().
> 
> Found in Mutt 2.0.5 (Debian 11 + 2.0.5-4.1+deb11u1).
> 
> Reproducible in:
> 
> 2.1.4 (Ubuntu 22.04LTS + binary package 2.1.4-1ubuntu1.1)
> 2.2.6 (Debian 11 + 2.2.6 tarball)
> 2.2.7 (Debian 11 + stable git source)
> Public mailing list archive to problematic mail here (I can provide mbox file 
> from my own archive).
> 
> Simple workaround (crypt-gpgme.c):
> 
> 2425   if (!more)
> 2426+  {
> 2427+if ( uid == NULL )
> 2428+{
> 2429+  err=1;
> 2430+  break;
> 2431+}
> 2432 fprintf (*fp, "%s %5.5s %d/%8s %s %s\n", more ? "sub" : "pub",
> 2433   gpgme_pubkey_algo_name (subkey->pubkey_algo), 
> subkey->length,
> 2434   shortid, date, uid->uid);
> 2435+  }
> 2436   else

Well... I've made a local mutt package with this applied, and I'll see
how it goes.  I didn't save any of the landmine emails, but I'm guessing
there'll be more.



Re: Causing segmentations fault; Was: Re: No Public Key

2022-11-14 Thread Curt
On 2022-11-14,   wrote:
>
>> https://gitlab.com/muttmua/mutt/-/issues/428
>
> Is there a non-javascript-ey way to look at those issues?
>


Mutt crashes with SIGSEGV when uid -variable is NULL in 
pgp_gpgme_extrace_keys().

Found in Mutt 2.0.5 (Debian 11 + 2.0.5-4.1+deb11u1).

Reproducible in:

2.1.4 (Ubuntu 22.04LTS + binary package 2.1.4-1ubuntu1.1)
2.2.6 (Debian 11 + 2.2.6 tarball)
2.2.7 (Debian 11 + stable git source)
Public mailing list archive to problematic mail here (I can provide mbox file 
from my own archive).

Simple workaround (crypt-gpgme.c):

2425   if (!more)
2426+  {
2427+if ( uid == NULL )
2428+{
2429+  err=1;
2430+  break;
2431+}
2432 fprintf (*fp, "%s %5.5s %d/%8s %s %s\n", more ? "sub" : "pub",
2433   gpgme_pubkey_algo_name (subkey->pubkey_algo), 
subkey->length,
2434   shortid, date, uid->uid);
2435+  }
2436   else





Re: Causing segmentations fault; Was: Re: No Public Key

2022-11-14 Thread tomas
On Mon, Nov 14, 2022 at 05:46:25PM +0100, Sven Joachim wrote:
> On 2022-11-14 11:39 -0500, Greg Wooledge wrote:
> 
> > If anyone figures out a way to make mutt NOT segfault when reading this
> > type of email, I'd love to hear it.
> 
> Upgrading to 2.2.8 or later should do the trick.  I can confirm that
> mutt 2.2.9-1 in unstable no longer segfaults displaying the message in
> question.

Thanks!

(btw, Gökşin's new message segfaults my mutt, Mutt 2.0.5 (2021-01-21) too)

> https://gitlab.com/muttmua/mutt/-/issues/428

Is there a non-javascript-ey way to look at those issues?

Cheers
-- 
t


signature.asc
Description: PGP signature


Re: Causing segmentations fault; Was: Re: No Public Key

2022-11-14 Thread David Wright
On Mon 14 Nov 2022 at 11:39:11 (-0500), Greg Wooledge wrote:
> On Mon, Nov 14, 2022 at 07:33:00PM +0300, Gökşin Akdeniz wrote:
> > 14.11.2022 15:26 tarihinde Anssi Saari yazdı:
> > > 
> > > So does mutt try to check the PGP signature in Gökşin's message and
> > > crash due to that or some other issue?
> > > 
> > 
> > I use Thunderbird for reading, composing,sending e-mail and signing and
> > encrypting, decrypting e-mail messages.
> > 
> > Probably it is why mutt and GnuPG had troubles.
> 
> This message also caused mutt to segfault when I tried to open it and
> read it.  I can press L from the index to reply-to-list, which I'm
> doing now.  But I can't read the original.
> 
> If anyone figures out a way to make mutt NOT segfault when reading this
> type of email, I'd love to hear it.

No problem here on bullseye with mutt "Mutt/2.0.5 (2021-01-21)", but
that might be because I'm unconcerned about checking signatures, so
something might be uninstalled or unconfigured. Here's what I see
when Gökşin Akdeniz's second message is read:

--✄

Date: Mon, 14 Nov 2022 19:33:00 +0300
From: Gökşin Akdeniz 
Subject: Re: Causing segmentations fault; Was: Re: No Public Key
X-Original-To: deb...@lionunicorn.co.uk
X-Original-To: lists-debian-u...@bendel.debian.org

[-- PGP output follows (current time: Mon Nov 14 11:05:42 2022) --]
gpg: keyblock resource '/usr/share/keyrings/debian-keyring.pgp': No such file 
or directory
gpg: Signature made Mon Nov 14 10:33:00 2022 CST
gpg:using EDDSA key 9BD18DF7E46ECBFB0E468C6D648AAD2AAA3BAD5F
gpg: Can't check signature: No public key
[-- End of PGP output --]

[-- The following data is signed --]

Subject: Re: Causing segmentations fault; Was: Re: No Public Key

[-- Attachment #1 --]
[-- Type: multipart/mixed, Encoding: 7bit, Size: 9.0K --]

[-- Attachment #1 --]
[-- Type: text/plain, Encoding: base64, Size: 0.5K --]



14.11.2022 15:26 tarihinde Anssi Saari yazdı:

>
> So does mutt try to check the PGP signature in Gökşin's message and
> crash due to that or some other issue?
>

I use Thunderbird for reading, composing,sending e-mail and signing and
encrypting, decrypting e-mail messages.

Probably it is why mutt and GnuPG had troubles.

[-- Attachment #2: OpenPGP public key --]
[-- Type: application/pgp-keys, Encoding: quoted-printable, Size: 8.1K --]

[-- PGP output follows (current time: Mon Nov 14 11:05:42 2022) --]
gpg: keyblock resource '/usr/share/keyrings/debian-keyring.pgp': No such file 
or directory
[-- End of PGP output --]

[-- BEGIN PGP PUBLIC KEY BLOCK --]
pub   ed25519 2022-02-13 [SC] [expires: 2023-02-13]
  9BD18DF7E46ECBFB0E468C6D648AAD2AAA3BAD5F
uid   Gökşin Akdeniz (*BSD User, GNU/Linux User, eniXma Founder, eniXma 
Author, Scholar)
+
sub   cv25519 2022-02-13 [E] [expires: 2023-02-13]
pub   rsa4096 2020-02-08 [SCEA] [revoked: 2021-03-29]
  D33E279317FA00ACB438E040F4E1EEA55B6F910A
sub   rsa4096 2020-02-08 [E] [revoked: 2021-03-29]
pub   rsa2048 2015-01-06 [SCEA] [revoked: 2016-05-04]
  5584E544E1541B128ADD4802DDC4D6DAAC7DCCF7
sub   rsa2048 2015-01-06 [E] [revoked: 2016-05-04]
pub   rsa4096 2019-02-06 [SCEA] [revoked: 2020-02-08]
  00E7125AF1F0BD88BAB4D5E9443D65289EFEC656
sub   rsa4096 2019-02-06 [E] [revoked: 2020-02-08]

[-- END PGP PUBLIC KEY BLOCK --]



[-- End of signed data --]

--✄

Make of that what you will.

Cheers,
David.


Re: Causing segmentations fault; Was: Re: No Public Key

2022-11-14 Thread Sven Joachim
On 2022-11-14 11:39 -0500, Greg Wooledge wrote:

> If anyone figures out a way to make mutt NOT segfault when reading this
> type of email, I'd love to hear it.

Upgrading to 2.2.8 or later should do the trick.  I can confirm that
mutt 2.2.9-1 in unstable no longer segfaults displaying the message in
question.

https://gitlab.com/muttmua/mutt/-/issues/428

Cheers,
   Sven



Re: Causing segmentations fault; Was: Re: No Public Key

2022-11-14 Thread Greg Wooledge
On Mon, Nov 14, 2022 at 07:33:00PM +0300, Gökşin Akdeniz wrote:
> 
> 
> 14.11.2022 15:26 tarihinde Anssi Saari yazdı:
> 
> > 
> > So does mutt try to check the PGP signature in Gökşin's message and
> > crash due to that or some other issue?
> > 
> 
> I use Thunderbird for reading, composing,sending e-mail and signing and
> encrypting, decrypting e-mail messages.
> 
> Probably it is why mutt and GnuPG had troubles.

This message also caused mutt to segfault when I tried to open it and
read it.  I can press L from the index to reply-to-list, which I'm
doing now.  But I can't read the original.

If anyone figures out a way to make mutt NOT segfault when reading this
type of email, I'd love to hear it.



Re: Causing segmentations fault; Was: Re: No Public Key

2022-11-14 Thread Gökşin Akdeniz



14.11.2022 15:26 tarihinde Anssi Saari yazdı:



So does mutt try to check the PGP signature in Gökşin's message and
crash due to that or some other issue?



I use Thunderbird for reading, composing,sending e-mail and signing and 
encrypting, decrypting e-mail messages.


Probably it is why mutt and GnuPG had troubles.


OpenPGP_0x648AAD2AAA3BAD5F_and_old_rev.asc
Description: OpenPGP public key


OpenPGP_signature
Description: OpenPGP digital signature


Re: Causing segmentations fault; Was: Re: No Public Key

2022-11-14 Thread Anssi Saari
steve  writes:

> Le 14-11-2022, à 08:58:02 +0100, to...@tuxteam.de a écrit :
>
>>On Mon, Nov 14, 2022 at 08:51:47AM +0100, Henning Follmann wrote:
>>
>>[...]
>>
>>> Mutt crashes trying to open this post (while opening gnupg).
>>> That's weird.
>>
>>Confirmed.
>
> Here too.
>
> mutt 2.2.7 (2022-08-07)

So does mutt try to check the PGP signature in Gökşin's message and
crash due to that or some other issue?



Re: Causing segmentations fault; Was: Re: No Public Key

2022-11-14 Thread Thomas Pircher

Henning Follmann wrote:

Mutt crashes trying to open this post (while opening gnupg).
That's weird.


When I save the message as attachment, and run gnupg over it, I get this
error message

| gpg: CRC error; 3B73F1 - DC33B7
| gpg: quoted printable character in armor - probably a buggy MTA has been used

GnuPG exits with error code 2. I guess mutt does gpg not expect to fail.

Thomas



Re: Causing segmentations fault; Was: Re: No Public Key

2022-11-14 Thread steve

Le 14-11-2022, à 08:58:02 +0100, to...@tuxteam.de a écrit :


On Mon, Nov 14, 2022 at 08:51:47AM +0100, Henning Follmann wrote:

[...]


Mutt crashes trying to open this post (while opening gnupg).
That's weird.


Confirmed.


Here too.

mutt 2.2.7 (2022-08-07)



Re: No Public Key

2022-11-14 Thread Thomas Schmitt
Hi,

Thomas George wrote:
> I thought to skip this step and tried
> gpg --verify SHA515SUMS.sign.txt debian-11.5.0-amd64-netinst.iso

That's not the right way.
SHA515SUMS.sign verifies SHA515SUMS
SHA515SUMS verifies debian-11.5.0-amd64-netinst.iso

The latter step can be done by this command in the directory where
SHA515SUMS and debian-11.5.0-amd64-netinst.iso have been downloaded:

  sha512sum -c SHA515SUMS

This is supposed to report:

  debian-11.5.0-amd64-netinst.iso: OK
  sha512sum: debian-edu-11.5.0-amd64-netinst.iso: No such file or directory
  debian-edu-11.5.0-amd64-netinst.iso: FAILED open or read
  sha512sum: debian-mac-11.5.0-amd64-netinst.iso: No such file or directory
  debian-mac-11.5.0-amd64-netinst.iso: FAILED open or read
  sha512sum: WARNING: 2 listed files could not be read

The errors and warnings are emitted because only one of the listed ISOs was
downloaded. Decisive is the line

  debian-11.5.0-amd64-netinst.iso: OK

--

Having the necessary public keys i get from the first verification step

  gpg --verify SHA512SUMS.sign SHA512SUMS

this report

  gpg: Signature made Sun 11 Sep 2022 01:00:08 AM CEST using RSA key ID 6294BE9B
  gpg: Good signature from "Debian CD signing key "
  gpg: WARNING: This key is not certified with a trusted signature!
  gpg:  There is no indication that the signature belongs to the owner.
  Primary key fingerprint: DF9B 9C49 EAA9 2984 3258  9D76 DA87 E80D 6294 BE9B


Untested proposal:

If none of the method given so far work for getting that public key, i
would try the link in line
  pub   rsa4096/DA87E80D6294BE9B 2011-01-05 [SC]
of
  https://www.debian.org/CD/verify

I.e.

  wget https://www.debian.org/CD/key-DA87E80D6294BE9B.txt

and then

  gpg --import key-DA87E80D6294BE9B.txt

(I will not try this gpg --import step here, out of superstition not to
change things which already work.
There are many web sites which show such examples. Like:
  https://linuxhint.com/export-import-keys-with-gpg/
)


Have a nice day :)

Thomas



Re: Causing segmentations fault; Was: Re: No Public Key

2022-11-13 Thread tomas
On Mon, Nov 14, 2022 at 08:51:47AM +0100, Henning Follmann wrote:

[...]

> Mutt crashes trying to open this post (while opening gnupg).
> That's weird.

Confirmed.

Cheers
-- 
t


signature.asc
Description: PGP signature


Causing segmentations fault; Was: Re: No Public Key

2022-11-13 Thread Henning Follmann
On Sun, Nov 13, 2022 at 11:46:22PM +0300, Gökşin Akdeniz wrote:
> Hello,
> 
> 13.11.2022 22:14 tarihinde Thomas George yazdı:
> > I want to do a new verified instillation of a debian iso. I have the iso
> > and SHA512SUMS.sign.txt and SHHA512SUMS.txt and have tried
> > 
> > gpg --verify SHA512SUMS.sign.txt SHA512SUMS.txt with the result No
> > Public Key
> > 
> 
> Debian public keys are listed on web pages for downloads. Here is the link
> for download page with checksums and public keys.
> 
> https://www.debian.org/download
> 
> Keys:
> https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/SHA512SUMS.sign
> 
> Checksums:
> https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/SHA512SUMS
> 
> > A reference to a step-by-step procedure would be appreciated.
> > 
> 
> 1. Get GnuPG key info from SHA512SUMS.sign with command "gpg --verify
> SHA512SUM.sign SHA512SUMS"
> 
> 2.GnuPG will report for missing keys in keyring. Simply copy GnuPG key id
> "DF9B9C49EAA9298432589D76DA87E80D6294BE9B" from output.
> 
> 3 Get public key from Debian Keyservers with command: "gpg --key-server
> keyring.debian.org --recv-keys DF9B9C49EAA9298432589D76DA87E80D6294BE9B"
> 
> 4.GnuPG will download the public key.
> 
> 5. Rerun verify command for checksum control: "gpg --verify SHA512SUM.sign
> SHA512SUMS"
> 
> 6. GnuPG will report if the SHA512SUMS file signature matches with
> SHA512SUM.sign
> 
> 7. If checksum of file is correct, then check the integrity of ISO files.:
> "sha512sum debian-11.5.0-amd64-netinst.iso"
> 
> 7.Calculated checksums and SHA512SUMS should match.
> 
> 
> I hope, it helps.

Mutt crashes trying to open this post (while opening gnupg).
That's weird.

-H


-- 
Henning Follmann   | hfollm...@itcfollmann.com



Re: No Public Key

2022-11-13 Thread Henning Follmann
On Sun, Nov 13, 2022 at 07:27:21PM -0500, Thomas George wrote:
> Still strugglng. command suggested returns new key but no user id - skipped
> 
Please do not top post, especially not if answers were posted
properly in a chronological way.

here is what you should try:
gpg --keyserver keyring.debian.org --receive-keys 42468F4009EA8AC3

The previous recommended code used the fingerprint not the ID.
You should also specify the debian keyring because a lot of keyserver strip
the ID for anonymous requests.

-H



-- 
Henning Follmann   | hfollm...@itcfollmann.com



Re: No Public Key

2022-11-13 Thread Thomas George

Still strugglng. command suggested returns new key but no user id - skipped

On 11/13/22 15:08, Darac Marjal wrote:


On 13/11/2022 19:14, Thomas George wrote:
I want to do a new verified instillation of a debian iso. I have the 
iso and SHA512SUMS.sign.txt and SHHA512SUMS.txt and have tried


gpg --verify SHA512SUMS.sign.txt SHA512SUMS.txt with the result No 
Public Key


I thought to skip this step and tried

gpg --verify SHA515SUMS.sign.txt debian-11.5.0-amd64-netinst.iso with 
the result Can't open signed data debian-11.5.0-amd64-netinst.iso


Clearly I am making some elementary mistakes. I have spent fruitless 
hours trying find and use a public key. One source suggested Curl 
ipinfo.io/ip. This outputs an ip address that seams to have nothing 
to do with my problem.


A reference to a step-by-step procedure would be appreciated.


https://www.debian.org/CD/verify says "The keys used for these 
signatures are all in the Debian GPG keyring and the best way to check 
them is to use that keyring to validate via the web of trust.". If you 
are using a Debian system, you can get those keys by installing 
"debian-archive-keyring". IF you're not (which is likely, given you're 
trying to install Debian), then that page also lists the fingerprints 
of the keys:


pub   rsa4096/988021A964E6EA7D 2009-10-03
  Key fingerprint = 1046 0DAD 7616 5AD8 1FBC  0CE9 9880 21A9 64E6 
EA7D

uid  Debian CD signing key 

pub   rsa4096/DA87E80D6294BE9B 2011-01-05 [SC]
  Key fingerprint = DF9B 9C49 EAA9 2984 3258  9D76 DA87 E80D 6294 
BE9B

uid  Debian CD signing key 

pub   rsa4096/42468F4009EA8AC3 2014-04-15 [SC]
  Key fingerprint = F41D 3034 2F35 4669 5F65  C669 4246 8F40 09EA 
8AC3
uid  Debian Testing CDs Automatic Signing Key 



So you should just be able to do, for example:

    $ gpg --receive-keys "1046 0DAD 7616 5AD8 1FBC  0CE9 9880 21A9 
64E6 EA7D"





Tom George





Re: No Public Key

2022-11-13 Thread Thomas George

Still struggling command 3 below responds invalid option --key-server

On 11/13/22 15:46, Gökşin Akdeniz wrote:

Hello,

13.11.2022 22:14 tarihinde Thomas George yazdı:
I want to do a new verified instillation of a debian iso. I have the 
iso and SHA512SUMS.sign.txt and SHHA512SUMS.txt and have tried


gpg --verify SHA512SUMS.sign.txt SHA512SUMS.txt with the result No 
Public Key




Debian public keys are listed on web pages for downloads. Here is the 
link for download page with checksums and public keys.


https://www.debian.org/download

Keys: 
https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/SHA512SUMS.sign


Checksums: 
https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/SHA512SUMS



A reference to a step-by-step procedure would be appreciated.



1. Get GnuPG key info from SHA512SUMS.sign with command "gpg --verify 
SHA512SUM.sign SHA512SUMS"


2.GnuPG will report for missing keys in keyring. Simply copy GnuPG key 
id "DF9B9C49EAA9298432589D76DA87E80D6294BE9B" from output.


3 Get public key from Debian Keyservers with command: "gpg 
--key-server keyring.debian.org --recv-keys 
DF9B9C49EAA9298432589D76DA87E80D6294BE9B"


4.GnuPG will download the public key.

5. Rerun verify command for checksum control: "gpg --verify 
SHA512SUM.sign SHA512SUMS"


6. GnuPG will report if the SHA512SUMS file signature matches with 
SHA512SUM.sign


7. If checksum of file is correct, then check the integrity of ISO 
files.: "sha512sum debian-11.5.0-amd64-netinst.iso"


7.Calculated checksums and SHA512SUMS should match.


I hope, it helps.




Re: No Public Key

2022-11-13 Thread Gökşin Akdeniz

Hello,

13.11.2022 22:14 tarihinde Thomas George yazdı:
I want to do a new verified instillation of a debian iso. I have the iso 
and SHA512SUMS.sign.txt and SHHA512SUMS.txt and have tried


gpg --verify SHA512SUMS.sign.txt SHA512SUMS.txt with the result No 
Public Key




Debian public keys are listed on web pages for downloads. Here is the 
link for download page with checksums and public keys.


https://www.debian.org/download

Keys: 
https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/SHA512SUMS.sign


Checksums: 
https://cdimage.debian.org/debian-cd/current/amd64/iso-cd/SHA512SUMS



A reference to a step-by-step procedure would be appreciated.



1. Get GnuPG key info from SHA512SUMS.sign with command "gpg --verify 
SHA512SUM.sign SHA512SUMS"


2.GnuPG will report for missing keys in keyring. Simply copy GnuPG key 
id "DF9B9C49EAA9298432589D76DA87E80D6294BE9B" from output.


3 Get public key from Debian Keyservers with command: "gpg --key-server 
keyring.debian.org --recv-keys DF9B9C49EAA9298432589D76DA87E80D6294BE9B"


4.GnuPG will download the public key.

5. Rerun verify command for checksum control: "gpg --verify 
SHA512SUM.sign SHA512SUMS"


6. GnuPG will report if the SHA512SUMS file signature matches with 
SHA512SUM.sign


7. If checksum of file is correct, then check the integrity of ISO 
files.: "sha512sum debian-11.5.0-amd64-netinst.iso"


7.Calculated checksums and SHA512SUMS should match.


I hope, it helps.


OpenPGP_0x648AAD2AAA3BAD5F_and_old_rev.asc
Description: OpenPGP public key


OpenPGP_signature
Description: OpenPGP digital signature


Re: No Public Key

2022-11-13 Thread Darac Marjal


On 13/11/2022 19:14, Thomas George wrote:
I want to do a new verified instillation of a debian iso. I have the 
iso and SHA512SUMS.sign.txt and SHHA512SUMS.txt and have tried


gpg --verify SHA512SUMS.sign.txt SHA512SUMS.txt with the result No 
Public Key


I thought to skip this step and tried

gpg --verify SHA515SUMS.sign.txt debian-11.5.0-amd64-netinst.iso with 
the result Can't open signed data debian-11.5.0-amd64-netinst.iso


Clearly I am making some elementary mistakes. I have spent fruitless 
hours trying find and use a public key. One source suggested Curl 
ipinfo.io/ip. This outputs an ip address that seams to have nothing to 
do with my problem.


A reference to a step-by-step procedure would be appreciated.


https://www.debian.org/CD/verify says "The keys used for these 
signatures are all in the Debian GPG keyring and the best way to check 
them is to use that keyring to validate via the web of trust.". If you 
are using a Debian system, you can get those keys by installing 
"debian-archive-keyring". IF you're not (which is likely, given you're 
trying to install Debian), then that page also lists the fingerprints of 
the keys:


pub   rsa4096/988021A964E6EA7D 2009-10-03
  Key fingerprint = 1046 0DAD 7616 5AD8 1FBC  0CE9 9880 21A9 64E6 EA7D
uid  Debian CD signing key 

pub   rsa4096/DA87E80D6294BE9B 2011-01-05 [SC]
  Key fingerprint = DF9B 9C49 EAA9 2984 3258  9D76 DA87 E80D 6294 BE9B
uid  Debian CD signing key 

pub   rsa4096/42468F4009EA8AC3 2014-04-15 [SC]
  Key fingerprint = F41D 3034 2F35 4669 5F65  C669 4246 8F40 09EA 8AC3
uid  Debian Testing CDs Automatic Signing Key 



So you should just be able to do, for example:

    $ gpg --receive-keys "1046 0DAD 7616 5AD8 1FBC  0CE9 9880 21A9 64E6 
EA7D"





Tom George



OpenPGP_signature
Description: OpenPGP digital signature


No Public Key

2022-11-13 Thread Thomas George
I want to do a new verified instillation of a debian iso. I have the iso 
and SHA512SUMS.sign.txt and SHHA512SUMS.txt and have tried


gpg --verify SHA512SUMS.sign.txt SHA512SUMS.txt with the result No 
Public Key


I thought to skip this step and tried

gpg --verify SHA515SUMS.sign.txt debian-11.5.0-amd64-netinst.iso with 
the result Can't open signed data debian-11.5.0-amd64-netinst.iso


Clearly I am making some elementary mistakes. I have spent fruitless 
hours trying find and use a public key. One source suggested Curl 
ipinfo.io/ip. This outputs an ip address that seams to have nothing to 
do with my problem.


A reference to a step-by-step procedure would be appreciated.

Tom George



Re: Faulty .iso? No public key...

2018-01-09 Thread Jonathan Dowland
What does "apt policy debian-archive-keyring" show? Which version (if
any) do you have installed?

You could also try "apt install debian-archive-keyring"

This should clear up the issues with stretch-updates, but not the
virtualbox repository. For that you'll need to find, verify and import
the relevant key for that repository to get apt to accept it.

Note that virtualbox is available from Debian itself in stretch-
backports.



Re: Faulty .iso? No public key...

2018-01-09 Thread didier gaumet
Le 09/01/2018 à 07:33, Josh W. a écrit :
> I keep having the issue of no public key available and I don’t know what
> I should do…. Back up my computer and reinstall or is there a way to
> patch it up. I am attaching a file that shows what I am going through. I
> ran into all this this time will trying to install wine and adding to
> the sources.list file. I’ve had this problem with keys every since I
> downloaded the .iso for Debian Stretch… I am think that I might have
> gotten a faulty .iso file. Could some one point me in the direction of
> learning to check the checksum of a file or files. I would greatly
> appreciate it.
> 
> 
> 
> Joshua mailto:joshw8...@gmail.com>>

Maybe reconfiguring of reinstalling debian-archive-keyring package could
solve your problem?



Re: Faulty .iso? No public key...

2018-01-09 Thread Thomas Schmitt
Hi,

besides the good advise of John Doe about verifying an ISO, it should be
stated that "no public key available" during installation is not a typical
sign for a damaged ISO.
I'd rather suspect its intentional content being not being correct or maybe
the package mirror server not being up to date.

Josh W. wrote:
> I keep having the issue of no public key available

Did you already report details ?
Which ISO image file exactly ? Can you tell the mirror server address ?


Have a nice day :)

Thomas



Re: Faulty .iso? No public key...

2018-01-08 Thread john doe

On 1/9/2018 7:33 AM, Josh W. wrote:

I keep having the issue of no public key available and I don’t know what I
should do…. Back up my computer and reinstall or is there a way to patch it
up. I am attaching a file that shows what I am going through. I ran into
all this this time will trying to install wine and adding to the
sources.list file. I’ve had this problem with keys every since I downloaded
the .iso for Debian Stretch… I am think that I might have gotten a faulty
.iso file. Could some one point me in the direction of learning to check
the checksum of a file or files. I would greatly appreciate it.





To checksum a file you will need to use the corresponding checksum utility:
md5sum for MD5SUMS
sha1sum for SHA1SUMS
sha256 for SHA256SUMS
sha512sum for SHA512SUMS

On the download page for the desired iso file you have also 'SHA512SUMS' 
and 'SHA512SUMS.sign'.

You download both files using for instance 'wget'.

The first step is to verify the signature in 'SHA512SUMS' using 'gpg 
--verify *.sign'.
When you see 'good signature from ...', you have successfully verified 
the iso.


To checksum SHA512SUMS you would do:

$ sha512sum -c SHA512SUMS 2>&1 | grep -i ok

If you see something ending with ': ok', you have successfully 
checksummed the iso.


--
John Doe



Faulty .iso? No public key...

2018-01-08 Thread Josh W.
I keep having the issue of no public key available and I don’t know what I
should do…. Back up my computer and reinstall or is there a way to patch it
up. I am attaching a file that shows what I am going through. I ran into
all this this time will trying to install wine and adding to the
sources.list file. I’ve had this problem with keys every since I downloaded
the .iso for Debian Stretch… I am think that I might have gotten a faulty
.iso file. Could some one point me in the direction of learning to check
the checksum of a file or files. I would greatly appreciate it.



Joshua 


Key Problems.odt
Description: application/vnd.oasis.opendocument.text


Re: "no public key" warning on upgrade to stretch

2017-06-22 Thread Henrique de Moraes Holschuh
On Thu, 22 Jun 2017, Charles E. Blair wrote:
>When I type "apt-get upgrade" I get
> this message, and things stop:
> 
> W: There is no public key available for the following key IDs:
> EF0F382A1A7B6500
> 
>I hope there is a simple fix.

You can ignore the warning _in this specific instance_: it is expected,
and apt is using another key to verify the downloads.

This warning will be fixed for the Debian 8.9 oldstable point-release
(due in about a month or so), which adds the missing key.

-- 
  Henrique Holschuh



"no public key" warning on upgrade to stretch

2017-06-22 Thread Charles E. Blair
   When I type "apt-get upgrade" I get
this message, and things stop:

W: There is no public key available for the following key IDs:
EF0F382A1A7B6500

   I hope there is a simple fix.