{{Header}} {{Title|title= Download the Signing Key for {{project_name_short}} KVM }} {{#seo: |description=Get {{project_name_short}} KVM signing key. Verify {{project_name_short}} KVM. |image=Signingkeykvm.jpg }}
* [[Main/Project Signing Key|{{project_name_short}} Main, VirtualBox, APT Repository and Source Code Signing Key]] * [[KVM/Project Signing Key|{{project_name_short}} KVM Signing Key]]
[[image:Signingkeykvm.jpg|thumb]] {{intro| Get {{project_name_short}} KVM signing key. Verify {{project_name_short}} KVM. }} = Introduction = Since all {{project_name_short}} KVM releases are signed with the same key, it is unnecessary to verify the key every time a new release is announced. Trust in the key might gradually increase over time, but cryptographic signatures must still be verified every time a new release is downloaded. This page is strongly related to the [[Trust|Placing Trust in {{project_name_short}}]] page. {{Anchor|Download the Key}} = Download the OpenPGP Key = {{Box|text= {{gpg_init}} }} {{Box|text= '''1.''' [[Secure_Downloads|Securely]] download {{project_name_short}} KVM developer HulaHoop's [[OpenPGP]] key. {{CodeSelect|code= curl {{Curl_Secure}} --max-time 180 --output ~/hulahoop.asc https://www.{{project_clearnet}}/keys/hulahoop.asc }}
{{signing_key_kvm}} '''2.''' Store the key as hulahoop.asc. '''3.''' Check fingerprints/owners without importing anything. {{CodeSelect|code= gpg --keyid-format long --import --import-options show-only --with-fingerprint hulahoop.asc }} '''4.''' Verify the output. The most important check is confirming the key fingerprint exactly matches the output below. Minor changes in the output such as new uids (email addresses) or newer expiration dates are inconsequential.
      Key fingerprint = 04EF 2F66 6D36 C354 058B  9DD4 50C7 8B6F 9FF2 EC85
The message gpg: key 50C78B6F9FF2EC85: 1 signature not checked due to a missing key is related to the [[OpenPGP#The_OpenPGP_Web_of_Trust|The OpenPGP Web of Trust]]. Advanced users can learn more about this [[#OpenPGP Web of Trust|below]]. {{mbox | image = [[File:Ambox_warning_pn.svg.png|warning|40px]] | text = '''Warning:''' Do not continue if the fingerprint does not match! This risks using infected or erroneous files! The whole point of verification is to confirm file integrity. }} '''5.''' Import the key. {{CodeSelect|code= gpg --import hulahoop.asc }} The output should include the key was imported.
gpg: Total number processed: 1
gpg:               imported: 1
''If the {{project_name_short}} signing key was already imported in the past'', the output should include the key is unchanged.
gpg: Total number processed: 1
gpg:              unchanged: 1
If the following message appears at the end of the output.
gpg: no ultimately trusted keys found
This extra message does not relate to the {{project_name_short}} signing key itself, but instead usually means the user has not created an OpenPGP key yet, which is of no importance when verifying virtual machine images. Analyze the other messages as usual. '''6.''' Advanced users can check [[#Web of Trust|Web of Trust]] further below for better security. '''7.''' Complete the {{project_name_short}} verification steps. If verifying {{project_name_short}} images, navigate to the relevant verification page below to finish the process: * [[Verify_the_virtual_machine_images_using_Linux|Linux]] }} = OpenPGP Key Features = * sign/verify {{project_name_short}} KVM images: yes * sending encrypted e-mails to {{project_name_short}} KVM developer HulaHoop: no = Advanced Users = {{Anchor|Web of Trust}} == OpenPGP Web of Trust == {{mbox | image = [[File:Ambox_warning_pn.svg.png|40px]] | text = Advanced users only! }} HulaHoop's OpenPGP key can be verified through [[OpenPGP#The_OpenPGP_Web_of_Trust|The OpenPGP Web of Trust]]. {{project_name_short}} [[Patrick Schleizer]]'s (adrelanos') has OpenPGP signed {{project_name_short}} KVM developer HulaHoop's OpenPGP key. {{Box|text= '''1.''' First, acquire Patrick's signing key. Refer the the more secure, detailed [[Main/Project Signing Key|{{project_name_short}} Main, VirtualBox, APT Repository and Source Code Signing Key]] instructions. '''2.''' Verify the key was also signed by {{project_name_short}} lead developer [[Patrick_Schleizer|Patrick Schleizer]]. {{CodeSelect|code= gpg --check-sigs "04EF 2F66 6D36 C354 058B 9DD4 50C7 8B6F 9FF2 EC85" }} The output should be identical to the message below.
pub   rsa4096/0x50C78B6F9FF2EC85 2018-11-26 [SCEA]
      04EF2F666D36C354058B9DD450C78B6F9FF2EC85
uid                   [ unknown] HulaHoop
sig!         0x8D66066A2EEACCDA 2018-12-14  Patrick Schleizer 
sig!3        0x50C78B6F9FF2EC85 2018-11-26  HulaHoop
sub   rsa4096/0xEB27D2F8CEE41ACC 2018-11-26 [SEA]
sig!         0x50C78B6F9FF2EC85 2018-11-26  HulaHoop

gpg: 3 good signatures
}} == Download the signify Key == {{mbox | type = notice | image = [[File:Ambox_notice.png|40px|alt=Info]] | text = Advanced users only! }}
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

untrusted comment: signify public key
RWT2GZDQkp1NtTAC1IoQHUsyb/AQ2LIQF82cygQU+riOpPWSq730A/rq
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEEZvRiRskAcH/xDcHk6yfS+M7kGswFAl9FA2ZfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDY2
RjQ2MjQ2QzkwMDcwN0ZGMTBEQzFFNEVCMjdEMkY4Q0VFNDFBQ0MACgkQ6yfS+M7k
Gsx0Ig//XIWcAU6FEy5BOPZp7mG6kGYUXJJNrMQzIW8JK49TlwHIRM6JjilUmn07
pV0Gq7RKAs9gLZWa4YbygUj0wZcaILLaqsmF0Np0mJuhkADiQVCJbLbrPanJACqy
cs/3ALqqVEYHmZgtmQzWGKOiwHF+g4UtSmr4iNo2ykssGfcx/FHifisoeRe/Bku1
E++Z01kwIesQbETMF9x/PakxEHl0hCAES9ReRXhoDj87i4BEzqVa8m+/PS7woQEQ
U6NA28ANreIpHYdQ2vGnWFc6JIrf5B10QVPd0JOwEO2w9efeVpgdCUNhA/SBx3jo
j0kZZsF9gGuybrSysd7Ftn9XxA/S5rmWOzIL2miRbSrZpd2n5k0zlhyZoHGVKg3S
bDhZr+Cw4BMMpiRcTtm11XwHcPDB4DkQL5MMrb+ISDe9Xy+zcEkGGY3da9JcNSQ8
6F9PziVyyO1jnOruZSoEmrB+vdKFl/yO007IIeByPCcsGdr1ITyEd6LAByV5SzxI
Xp98gOO07rwrH6rUYSE75ErRwqQM9pKoVCZQbTantss+6kXLxxXDSFbkmRmyBTVS
3+kyshd53CQSsShb9lwroBSQJEj/Rfh+X8bvZe7sQFKY9/3GT5fktEteY1qkOSX7
HYttYy0gOeaawq8RhRxN+l3oOi9Zwll3kOpagj5xvNyrfwayp/E=
=2wdp
-----END PGP SIGNATURE-----

untrusted comment: signify public key
RWT2GZDQkp1NtTAC1IoQHUsyb/AQ2LIQF82cygQU+riOpPWSq730A/rq
= Further Reading = * [https://en.wikipedia.org/wiki/GNU_Privacy_Guard GnuPG wikipedia] - free OpenPGP software. * [https://www.apache.org/dev/openpgp.html Apache: How To OpenPGP]. * [https://www.debian.org/events/keysigning Debian: Keysigning] - a tutorial on signing keys of other people. * [https://www.rubin.ch/pgp/weboftrust.en.html rubin.ch: An explanation of the PGP web of trust]. {{Template:GnuPG-Troubleshooting}} = See Also = * [[Verify the virtual machine images|Verify {{project_name_short}} Images]] * [[Verifying Software Signatures]] * [[Trust|Placing Trust in {{project_name_short}}]] * [[OpenPGP|OpenPGP key distribution strategies]] = License = {{License_Amnesia|{{FULLPAGENAME}}}} = Footnotes = {{reflist|close=1}} {{Footer}} [[Category:Documentation]] [[Category:MultiWiki]]