Verifying Solus Downloads

b23

Downloaded Solus Budgie and attempted to verify using the public key but was unsuccessful.

The download seems to be OK - used
certutil -hashfile ....\Downloads\Solus-Budgie-Release-2024-10-14.iso SHA256
and the hashes agreed but would like to get the public key verification working. Used
gpg --verify solus-releng-pub.gpg Solus-Budgie-Release-2024-10-14.iso
with fingerprint F5F6685CAF5559771D9CCB92618EB3600BD32D59, email releng@getsol.us that was available on the public servers.

Have I got this correct?

Staudey

https://help.getsol.us/docs/user/quick-start/installation/#verifying-the-sha256sums-file-signature

Are you following this guide? From the commands you posted it doesn't seem that way.

b23

Was initially processing through Kleopatra/GPG4Win on MS Win10 for previous outputs and didn't realise instructions were available. Ran

  gpg --import solus-releng-pub.gpg

  gpg: key 618EB3600BD32D59: "Solus (Release & Engineering) <releng@getsol.us>" not changed
  gpg: Total number processed: 1
  gpg:              unchanged: 1

So that part worked but the verify didn't:

  gpg --verify Solus-Budgie-Release-2024-10-14.iso.sha256sum.sign Solus-Budgie-Release-2024-10-14.iso.sha256sum

  gpg: can't open signed data 'Solus-Budgie-Release-2024-10-14.iso.sha256sum'
  gpg: can't hash datafile: No such file or directory

Basic issue turned out to be when clicking the Solus-Budgie-Release-2024-10-14.iso.sha256sum file link, it displayed rather than saving to the downloads directory, so was missing (other links downloaded). After saving:

gpg: Signature made 10/15/24 09:39:40 AUS Eastern Daylight Time
gpg:                using RSA key F5F6685CAF5559771D9CCB92618EB3600BD32D59
gpg: Good signature from "Solus (Release & Engineering) <releng@getsol.us>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: F5F6 685C AF55 5977 1D9C  CB92 618E B360 0BD3 2D59

So all good. Thanks for the response.