Re: Verifying Debian 9.9 with SHA and SHA.signatures

2019-05-24 Thread Thomas Schmitt 
Hi,

> I've never found any terminal commands to use the checksums, or the
> signing key.

Have a look at
  https://lists.debian.org/debian-user/2019/04/msg00214.html
  https://lists.debian.org/debian-user/2019/04/msg01149.html

The first one gives an overview. You already seem to know most of this.
It also shows examples of verification commands.

The second one is about john doe's proposal, which for now is the
best candidate for a SHA512 checksum verification command:

  sha512sum -c --ignore-missing SHA512SUMS

and about my proposal to verify the GPG signature directly on the remote
keyring:

  gpg --keyserver keyring.debian.org --verify SHA512SUMS.sign SHA512SUMS


> Please could Debian create some extra documentation on using commands to
> verify Debian's isos' with SHAs and signatures?

The need is known.
In
  https://lists.debian.org/debian-user/2019/04/msg01147.html
we see the announcement of improvement by the web team.


Have a nice day :)

Thomas

Verifying Debian 9.9 with SHA and SHA.signatures

2019-05-24 Thread Stefan.schultz19.5.1991 
Hello Debian support,

I'm quite new to open source, so learning lots, especially verifying os 
downloads. I can use the SHAs and SHAs.sign in various distros, but I hit a 
wall in Debian. I've read a lot on various Debian web pages like 'Verifying 
authenticity of Debian CDs', and scoured the 120 page Debian Jessie manual.

https://www.debian.org/CD/verify

I understand I have to use the SHAs to check the iso image. and the .sign to 
check the checksums.

I've imported one gpg key from

gpg --keyserver keyring.debian.org --recv-keys 0x673A03E4C1DB921F

But I've never found any terminal commands to use the checksums, or the signing 
key.
I've only managed to check the checksums in the Debian 9.9 iso, by doing it my 
Tails usb, by clicking on the properties of the iso, and then click on the 
'Digests' feature. The SHA256SUMS and SHA512SUMS, are the same as the 
downloaded checksums.

Unless my sonar for commands is malfunctioning, I cannot find any! If my sonar 
is defunct, please tell me!

In comparison, this is how Ubuntu and Mint describe checking isos. Two 
different presentations, but a novice like me can have piece of mind, that the 
downloads are correct. I will not be complacent, by assuming that they are 
perfect. A few times they have not been.

Two years ago Ubuntu was very confusing, but now it's educational too. Follow 
the arrows to the right

https://tutorials.ubuntu.com/tutorial/tutorial-how-to-verify-ubuntu#1

Mint explains everything on one page

https://linuxmint.com/verify.php

Question 1

Please could Debian create some extra documentation on using commands to verify 
Debian's isos' with SHAs and signatures?

Question 2

Is that a big ask for all the distros that Debian has available?

Being a Tails addict, I want to start using Debian.

Thank you in advance for any advice you have. I look forward to your replies.

Stefan

Sent from [ProtonMail](https://protonmail.com), Swiss-based encrypted email.