gpg: verify signatures failed: Unexpected error

Downloaded Whonix-XFCE- + hulahoop.asc

i checked every command in the verify section and all were going good until i reached to this command:

gpg --verify Whonix*.libvirt.xz.asc Whonix*.libvirt.xz

will give:

gpg: can't open 'Whonix*.libvirt.xz.asc': No Such file or directory
gpg: verify signatures failed: No such file or directory

I switched the naming of the key to the downloaded name which is hulahoop.asc:

gpg --verify hulahoop.asc Whonix*.libvirt.xz

will give:

gpg verify signatures failed: Unexpected error

This is happened because instructions wasnt for hulahoop.asc but it was for Whonix-XFCE-

so as a user this is confusion either give 2 instructions or ask to download both keys or fix commands or remove one of the keys.

another thing to be added is instructions to check sha512sums

This happens if you are not in the same directory the tarball and sig are in.

This is incorrect. You import the key and you verify the code, both in separate commands.

Everything works from my tests so there is some mistake on your end.

Redundant as any corrupted download will fail to give a good signature when verifying.

1 Like

same directory with hulahoop.asc or Whonix-XFCE-

whonix-kvm version is

ah i see, but isnt that as well good sign for the user to reset the download instead of using corrupted image?


whoever bothers to check the sig will know about the corruption problem. Those who won’t, won’t bother with checksums either and so it’s not worth complicating the setup process over.

1 Like

yeah that what i meant when i said

So may i suggest to you to make the table of the keys similar for example to the qubes one:


they add all of the keys into one side, no up and down.

for user what he will do is download all keys available then follow the instructions, so what is the different on our side then?

This line:

1. Download HulaHoop [archive]'s OpenPGP key from the website.

can be added with:

OpenPGP Signature ( sha512 , sig )

can be renamed to (or anything as you like):

HulaHoop [archive]'s , Whonix*.libvirt.xz.asc ( sha512 , sig )

and this line:

1. Download HulaHoop [archive]'s OpenPGP key from the website.

can be replaced with for e.g:

After you have downloaded whonix and the keys in the same path follow these commands

[Imprint] [Privacy Policy] [Cookie Policy] [Terms of Use] [E-Sign Consent] [DMCA] [Contributors] [Investors] [Priority Support] [Professional Support]