Actions

Download the Whonix ™ Signing Key for VirtualBox, Source Code and APT Repository

From Whonix



Introduction[edit]

Since all Whonix ™ VirtualBox releases are signed with the same key, it is unnecessary to verify the key every time a new release is announced. Trust in the key might gradually increase over time, but cryptographic signatures must still be verified every time a new release is downloaded.

This page is strongly related to the Placing Trust in Whonix ™ page.

Download the OpenPGP Key[edit]

Optional: Complete the steps below if unfamiliar with GnuPG or if they haven't already been performed. This will fix eventual gpg: WARNING: unsafe ownership warnings.

Have GnuPG initialize your user data folder.

gpg --fingerprint

Set warning free permissions.

chmod --recursive og-rwx ~/.gnupg

1. Securely download Patrick Schleizer's (adrelanos') OpenPGP key. [1]
patrick.asc

2. Store the key as patrick.asc.

3. Check fingerprints/owners without importing anything. [2]

gpg --keyid-format long --import --import-options show-only --with-fingerprint patrick.asc

4. Verify the output.

The output should be identical to the following.

gpg: key 8D66066A2EEACCDA: 104 signatures not checked due to missing keys
pub   rsa4096/8D66066A2EEACCDA 2014-01-16 [SC] [expires: 2026-01-23]
      Key fingerprint = 916B 8D99 C38E AF5E 8ADC  7A2A 8D66 066A 2EEA CCDA
uid                            Patrick Schleizer <adrelanos@riseup.net>
sub   rsa4096/3B1E6942CE998547 2014-01-16 [E] [expires: 2026-01-23]
sub   rsa4096/10FDAC53119B3FD6 2014-01-16 [A] [expires: 2026-01-23]
sub   rsa4096/CB8D50BB77BB3C48 2014-01-16 [S] [expires: 2026-01-23]

The message gpg: key 8D66066A2EEACCDA: 104 signatures not checked due to missing keys is related to the The OpenPGP Web of Trust. Advanced users can learn more about this below.

5. Import the key.

gpg --import patrick.asc

The output should confirm the key was imported.

gpg: key 8D66066A2EEACCDA: public key "Patrick Schleizer <adrelanos@riseup.net>" imported
gpg: Total number processed: 1
gpg:               imported: 1

If the Whonix ™ signing key was already imported in the past, the output should confirm the key is unchanged.

gpg: key 8D66066A2EEACCDA: "Patrick Schleizer <adrelanos@riseup.net>" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1

If the following message appears at the end of the output.

gpg: no ultimately trusted keys found

This extra message does not relate to the Whonix ™ signing key itself, but instead usually means the user has not created an OpenPGP key yet, which is of no importance when verifying virtual machine images.

Analyze the other messages as usual.

6. Advanced users can check Web of Trust further below for better security.

7. Complete the Whonix ™ verification steps.

If verifying Whonix ™ images, navigate to the relevant verification page below to finish the process:

Advanced Users[edit]

OpenPGP Web of Trust[edit]

A few people have signed Patrick Schleizer's (adrelanos') OpenPGP key in The OpenPGP Web of Trust.

Jan Dittberner [3] (Debian Developer) [4] signed Patrick's key. So did intrigeri (Tails developer, Debian Developer); Peter Palfrader (Debian Developer); Richard King; and Michael Carbone (accessnow.org).

Users relying on Debian or one of the many Debian derivatives (like Ubuntu) already trust apt-get, the APT repository of the relevant distribution. This means the Debian keyring can be installed as a trusted source for obtaining Jan's, intrigeri's or Peter's key, to check their signature on Patrick's key.

1. Update the package lists.

sudo apt-get update

2. Install the Debian keyring.

sudo apt-get install debian-keyring

3. Extract a signer's key from the Debian keyring and import it into your own keyring.

Here is an example using Jan's key.

gpg --no-default-keyring --keyring /usr/share/keyrings/debian-keyring.gpg --armor --export B2FF1D95CE8F7A22DF4CF09BA73E0055558FB8DD | gpg --import

4. Optional: Try to establish a better trust path to the signer by checking signatures on the signer's key.

Check signatures on Patrick's key.

gpg --check-sigs 916B8D99C38EAF5E8ADC7A2A8D66066A2EEACCDA

The output of the above command should show signatures on Patrick's key, which should include the signer's signature.

Download the signify Key[edit]

Info Advanced users only!

[5]

untrusted comment: Patrick Schleizer adrelanos@riseup.net signify public key
RWQ6KRormNEETq+M8IysxRe/HAWlqZRlO8u7ACIiv5poAW0ztsirOjCQ

Further Reading[edit]

See Also[edit]

License[edit]

Whonix ™ Main/Whonix Signing Key wiki page Copyright (C) Amnesia <amnesia at boum dot org>
Whonix ™ Main/Whonix Signing Key wiki page Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>

This program comes with ABSOLUTELY NO WARRANTY; for details see the wiki source code.
This is free software, and you are welcome to redistribute it under certain conditions; see the wiki source code for details.

Footnotes[edit]

  1. curl --tlsv1.2 --proto =https --max-time 180 --output ~/patrick.asc https://www.whonix.org/patrick.asc

  2. https://forums.whonix.org/t/gpg-show-key-warning-gpg-warning-no-command-supplied-trying-to-guess-what-you-mean/7859 [archive]
  3. http://www.dittberner.info/de/content/jan-dittberner [archive]
  4. https://qa.debian.org/developer.php?login=Jan+Dittberner [archive]
  5. -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA512
    
    untrusted comment: Patrick Schleizer adrelanos@riseup.net signify public key
    RWQ6KRormNEETq+M8IysxRe/HAWlqZRlO8u7ACIiv5poAW0ztsirOjCQ
    -----BEGIN PGP SIGNATURE-----
    
    iQKTBAEBCgB9FiEEbpebKKbzfEO+MK+hy41Qu3e7PEgFAl7vdyhfFIAAAAAALgAo
    aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDZF
    OTc5QjI4QTZGMzdDNDNCRTMwQUZBMUNCOEQ1MEJCNzdCQjNDNDgACgkQy41Qu3e7
    PEhVGw/+NtlBOVGoCS+wo9PssSoWVjHH6SfUFuHHGw6uF+tGoz8LowBDJykCWFrS
    UqTPBjxs9e9k8mLqKbvRYLS4MPjs0KP9Nx8kknsHx+t/EArqJ8fIR2Bs8ibVs51e
    LTU+0rP/uK/gimFVR36z9aZbmLvI9n8YrhIO1pZU97bC42h4rDDi/4qSnXHY9wFA
    56AYlgJwOO35aFM/I6eNuOdbqEgutcT5LG2S+BwO3Kg2BuoI+PcVUWjdYcjLJq+n
    8jjkBvLnCPe50CZBGKhd+rkJEd5+OXryxBqJwkRT/vJTfxvzyi8Gsm1cyKbBW1xJ
    YuKB1eY4ABegUa7N3OdUslEEZ3VvgWBqfepUMmNYLjaG8IQ8agYQwSbPnoh4pikq
    WbXFLI6VD/Kz9LkSB7i1GCyj+9GqNwsP7hJPxCUcERYH5dZJsxiX/uuH5cvFM4da
    VwABMrC3w7XTXFTXK/iZDuD8CZPNU3qPiFT4j3xJ48zZxglVFb7sRmmASJajmuJ6
    cv/ZTrNQgVfHsqw0+F9qPr4GZquoGoFpvxIdvPHe1U+uWt2AoLV+f4qvLlPlx7J8
    huftzcpkEKdHE5SKICCUrt3TxQ7JqFXyZBcgh2AaM9p8cqiOY5noLp1tAHzf1dQH
    DTrwKtgBPBUQhwtO0pw4PmeuBqjyzNzYHC68dYrsuKup5Jj+LNw=
    =3/Gv
    -----END PGP SIGNATURE-----
    


text=Jobs in USA
Jobs in USA


Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki


Follow: Twitter.png Facebook.png 1280px-Gab text logo.svg.png Iconfinder news 18421.png Rss.png Matrix logo.svg.png 1024px-Telegram 2019 Logo.svg.png Discourse logo.svg Reddit.jpg Diaspora.png Gnusocial.png Mewe.png 500px-Tumblr Wordmark.svg.png Iconfinder youtube 317714.png 200px-Minds logo.svg.png 200px-Mastodon Logotype (Simple).svg.png 200px-LinkedIn Logo 2013.svg.png

Donate: Donate Bank Wire Paypal Bitcoin accepted here Monero accepted here Contriute

Whonix donate bitcoin.png Monero donate whonix.png United Federation of Planets 1000px.png

Share: Twitter | Facebook

Interested in becoming an author for the Whonix News Blog [archive] or writing about anonymity, privacy and security? Please get in touch!

https link onion link

This is a wiki. Want to improve this page? Help is welcome and volunteer contributions are happily considered! Read, understand and agree to Conditions for Contributions to Whonix ™, then Edit! Edits are held for moderation. Policy of Whonix Website and Whonix Chat and Policy On Nonfreedom Software applies.

Copyright (C) 2012 - 2020 ENCRYPTED SUPPORT LP. Whonix ™ is a trademark. Whonix ™ is a licensee [archive] of the Open Invention Network [archive]. Unless otherwise noted, the content of this page is copyrighted and licensed under the same Freedom Software license as Whonix ™ itself. (Why?)

Whonix ™ is a derivative of and not affiliated with Debian [archive]. Debian is a registered trademark [archive] owned by Software in the Public Interest, Inc [archive].

Whonix ™ is produced independently from the Tor® [archive] anonymity software and carries no guarantee from The Tor Project [archive] about quality, suitability or anything else.

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent. Whonix ™ is provided by ENCRYPTED SUPPORT LP. See Imprint, Contact.