Verify Whonix ™ Images Software Signatures
From Whonix
Digital signatures can increase security but this requires knowledge. Learn more about digital software signature verification.
OpenPGP Signature[edit]
Qubes[edit]
Qubes-Whonix ™ templates are automatically verified when qubes-dom0-update downloads and installs them; manual user verification is unnecessary.
VirtualBox[edit]
Steps to verify the virtual machine images depend on the operating system in use:
Also see: VirtualBox Appliance is not signed Error Message.
KVM[edit]
Refer to the KVM 
Linux on the Command Line instructions.
Windows Installer[edit]
The Whonix ™ Windows Installer is currently unavailable. (Verify the Whonix ™ Windows Installer)
Signify Signatures[edit]
Advanced users only!
It is impossible to signify sign images (.ova / libvirt.tar.xz) directly. [archive] You can only verify the .sha512sums hash sum file using signify-openbsd and then verify the image against the sha512 sum.
1. Download the signify Key and save it as keyname.pub.
2. Install signify-openbsd.
Install signify-openbsd.
1. Update the package lists.
sudo apt-get update
2. Upgrade the system.
sudo apt-get dist-upgrade
3. Install the signify-openbsd package.
Using apt-get command line parameter --no-install-recommends is in most cases optional.
sudo apt-get install --no-install-recommends signify-openbsd
The procedure of installing signify-openbsd is complete.
3. Download the .sha512sums and .sha512sums.sig files.
4. Verify the .sha512sums file with signify-openbsd.
signify-openbsd -Vp keyname.pub -m Whonix-*.sha512sums
If the file is correct, it will output:
Signature Verified
If the file is not correct, it will output an error.
5. Compare the hash of the image file with the hash in the .sha512sums file.
sha512sum -c Whonix-*.sha512sums
If the file is correct, it will output:
Whonix-CLI-15.0.1.3.4.ova: OK
Do not continue if verification fails! This risks using infected or erroneous files! The whole point of verification is to confirm file integrity. This page is strongly related to the pages Placing Trust in Whonix ™ and Verifying Software Signatures.
If you are using signify for software signature verification, please consider making a report in the Whonix signify-openbsd forum thread [archive]. This will help developers decide whether to continue supporting this method or deprecate it.
Table: Whonix ™ VirtualBox Files
| Whonix ™ Version | Files |
|---|---|
| Whonix ™ VirtualBox CLI | |
| Whonix ™ VirtualBox XFCE |
Forum discussion: signify-openbsd [archive].
Codecrypt Signatures[edit]
Codecrypt signatures are not yet available, but are planned long term.
Volunteer contributions are happily considered! If you were to contribute codecrypt signature creation to the Whonix ™ prepare_release script [archive], then this feature could be provided much sooner.
If you would like to use codecrypt for software signature verification, please consider making a report in the Whonix codecrypt forum thread [archive]. This method might be supported sooner if there is sufficient interest.
Forum discussion:
use codecrypt to sign Whonix releases [archive].
See Also[edit]
- Download the Whonix ™ Signing Key
- Verifying Software Signatures
- Placing Trust in Whonix ™
- OpenPGP key distribution strategies
Whonix ™ is Supported by Evolution Host DDoS Protected VPS. Stay private and get your VPS with Bitcoin or Monero.
|
|
| Fosshost | About Advertisements |
Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki
.svg.png&filetimestamp=20200623163525&){kind=small}
Are you proficient with iptables? Want to contribute? Check out possible improvements to iptables. Please come and introduce yourself in the development forum.
Priority Support | Investors | Professional Support
Whonix ™ | © ENCRYPTED SUPPORT LP | 
Freedom Software / 
Open Source (Why?)
The personal opinions of moderators or contributors to the Whonix ™ project do not represent the project as a whole.