Installation Instructions - gpg

Louhy

JoshStrobl Hmm, I downloaded today from here under Solus Budgie: https://getsol.us/download/

Just tried again:

$ gpg --import joshua-strobl.gpg
gpg: key A2BE5892: "Joshua Strobl (Personal) <joshua@stroblindustries.com>" not changed
gpg: Total number processed: 1
gpg: unchanged: 1
$ gpg --verify Solus-4.0-Budgie.iso.sha256sum.sign Solus-4.0-Budgie.iso.sha256sum
gpg: Signature made Sun 17 Mar 2019 04:03:03 PM EDT using RSA key ID A2BE5892
gpg: Good signature from "Joshua Strobl (Personal) <joshua@stroblindustries.com>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 96B4 A029 1094 A86A 2B7E 3367 DD67 2FE9 A2BE 5892

JoshStrobl

Louhy Okay, when I get back to my office today I'll re-sign the files and make sure they're propagated on the mirrors. Thank you for bringing it to my attention.

JoshStrobl

I've re-signed the SHA256SUM files as .sign files, validated, and re-uploaded them.

pedalpowered

I'm having the same exact issue today for 4.1. And I redownloaded all three files, just in case and tried it again and received the same exact error. And I downloaded everything from https://getsol.us/download/.

DataDrake

This is an indication of a success, not a failure:

gpg --verify Solus-4.1-Budgie.iso.sha256sum.sign Solus-4.1-Budgie.iso.sha256sum
gpg: Signature made Fri 24 Jan 2020 02:24:46 PM EST using RSA key ID A2BE5892
gpg: Good signature from "Joshua Strobl (Personal) <joshua@stroblindustries.com>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 96B4 A029 1094 A86A 2B7E  3367 DD67 2FE9 A2BE 5892

If you are seeing additional errors, I cannot reproduce them. You may be experiencing file corruption during the download process. In which case I recommend using bittorrent, as it has much better integrity checking during the transfer.

Kindred

If I may add something...

This warning does not mean a thing?
But, what should I see after the last command?

After this: $ sha256sum -c Solus-4.1-Budgie.iso.sha256sum | grep OKI get nothing.
It takes a few seconds and a new $ appears.

When I shasum manually I get a different output.

$ sha256sum Solus-4.1-Budgie.iso.sha256sum
10fdac7f8ed6fd951927024d642099ddce25160c52d48c6cef927266788a9398  Solus-4.1-Budgie.iso.sha256sum

$ sha256sum Solus-4.1-Budgie.iso
4bf00f2f50e7024a71058c50c24a5706f9c18f618c013b8a819db33482577d17  Solus-4.1-Budgie.iso

davidjharder

Kindred If you check the contents of Solus-4.1-Budgie.iso.sha256sum you will see

4bf00f2f50e7024a71058c50c24a5706f9c18f618c013b8a819db33482577d17  Solus-4.1-Budgie.iso

which matches your command output. Maybe you ran the check function on the directory Solus-4.1-Budgie rather than the iso inside? This is what I did the first time I tried.

Kindred

Kindred After this: $ sha256sum -c Solus-4.1-Budgie.iso.sha256sum | grep OKI get nothing.
It takes a few seconds and a new $ appears.

^ ^ I did that...

Edit: but somehow now it seems to work.

Kindred

Hmm, strange, when I run this:

$ sha256sum Solus-4.1-Budgie.iso.sha256sum
I get this: 10fdac7f8ed6fd951927024d642099ddce25160c52d48c6cef927266788a9398 Solus-4.1-Budgie.iso.sha256sum

But when I open this file like you said and look into it there is this: 4bf00f2f50e7024a71058c50c24a5706f9c18f618c013b8a819db33482577d17 Solus-4.1-Budgie.iso

Sha256sum the iso directly in a terminal I get this:

$ sha256sum Solus-4.1-Budgie.iso
4bf00f2f50e7024a71058c50c24a5706f9c18f618c013b8a819db33482577d17 Solus-4.1-Budgie.iso

(I removed the iso from its folder.)

Staudey

Kindred

Kindred $ sha256sum Solus-4.1-Budgie.iso.sha256sum

You have to add the "-c" option, otherwise you're just getting the sha256 checksum of the sha256sum file, which is useless.

sha256sum -c Solus-4.1-Budgie.iso.sha256sum is the right command to run.
The output of that command should beSolus-4.1-Budgie.iso: OK

Staudey

Kindred Maybe it was just something simple like accidentally typing grep ok instead of grep OK. If there was an error with the checksum you would get an output anyway.

Vmulay

I get the same warnings as:

gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.

Does the owner need to do something for this to be trusted? My Sha256Sums match OK, but certification warning is there.