gpg: verify signatures failed: Unexpected error

[TNT_BOM_BOM]

Downloaded Whonix-XFCE-15.0.1.3.9.libvirt.xz + hulahoop.asc

i checked every command in the verify section and all were going good until i reached to this command:

gpg --verify Whonix*.libvirt.xz.asc Whonix*.libvirt.xz

will give:

gpg: can't open 'Whonix*.libvirt.xz.asc': No Such file or directory
gpg: verify signatures failed: No such file or directory

I switched the naming of the key to the downloaded name which is hulahoop.asc:

gpg --verify hulahoop.asc Whonix*.libvirt.xz

will give:

gpg verify signatures failed: Unexpected error

This is happened because instructions wasnt for hulahoop.asc but it was for Whonix-XFCE-15.0.1.3.9.libvirt.xz.asc

so as a user this is confusion either give 2 instructions or ask to download both keys or fix commands or remove one of the keys.

another thing to be added is instructions to check sha512sums

[HulaHoop]

@TNT_BOM_BOM

gpg: can't open 'Whonix*.libvirt.xz.asc': No Such file or directory
gpg: verify signatures failed: No such file or directory

This happens if you are not in the same directory the tarball and sig are in.

@TNT_BOM_BOM

I switched the naming of the key to the downloaded name which is hulahoop.asc:

This is incorrect. You import the key and you verify the code, both in separate commands.

@TNT_BOM_BOM

so as a user this is confusion either give 2 instructions or ask to download both keys or fix commands or remove one of the keys.

Everything works from my tests so there is some mistake on your end.

@TNT_BOM_BOM

another thing to be added is instructions to check sha512sums

Redundant as any corrupted download will fail to give a good signature when verifying.

[TNT_BOM_BOM]

@HulaHoop

This happens if you are not in the same directory the tarball and sig are in.

same directory with hulahoop.asc or Whonix-XFCE-15.0.1.3.9.libvirt.xz.asc?

whonix-kvm version is 15.0.1.3.9

@HulaHoop

Redundant as any corrupted download will fail to give a good signature when verifying.

ah i see, but isnt that as well good sign for the user to reset the download instead of using corrupted image?

[HulaHoop]

Whonix-XFCE-15.0.1.3.9.libvirt.xz.asc

@TNT_BOM_BOM

ah i see, but isnt that as well good sign for the user to reset the download instead of using corrupted image?

whoever bothers to check the sig will know about the corruption problem. Those who won’t, won’t bother with checksums either and so it’s not worth complicating the setup process over.

[TNT_BOM_BOM]

@HulaHoop

Whonix-XFCE-15.0.1.3.9.libvirt.xz.asc

yeah that what i meant when i said

@TNT_BOM_BOM

This is happened because instructions wasnt for hulahoop.asc but it was for Whonix-XFCE-15.0.1.3.9.libvirt.xz.asc

So may i suggest to you to make the table of the keys similar for example to the qubes one:

http://qubesosfasa4zl44o4tws22di6kepyzfeqv3tg4e3ztknltfxqrymdad.onion/downloads/

they add all of the keys into one side, no up and down.

for user what he will do is download all keys available then follow the instructions, so what is the different on our side then?

This line:

1. Download HulaHoop [archive]'s OpenPGP key from the website.

can be added with:

OpenPGP Signature ( sha512 , sig )

can be renamed to (or anything as you like):

HulaHoop [archive]'s , Whonix*.libvirt.xz.asc ( sha512 , sig )

and this line:

1. Download HulaHoop [archive]'s OpenPGP key from the website.

can be replaced with for e.g:

After you have downloaded whonix and the keys in the same path follow these commands