Editing Verify the images using Linux

{{Header}}
{{Title|title=
Verify Virtual Machine Images on Linux
}}
{{#seo:
|description=Instructions for OpenPGP and Signify Verification of {{project_name_long}} ISO, VirtualBox and KVM on the Command Line
|image=Approved-29149640.png
}}
[[File:Approved-29149640.png|250px|thumbnail]]
{{intro|
Instructions for OpenPGP and Signify Verification of {{project_name_short}} ISO, VirtualBox and KVM on the Command Line
}}
<!--
Copyright:

   Kicksecure Verify_the_images_using_Linux wiki page Copyright (C) Amnesia <amnesia at boum dot org>
   Kicksecure Verify_the_images_using_Linux wiki page Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@kicksecure.com>

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; either version 3 of the License, or
   (at your option) any later version.

   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.

   You should have received a copy of the GNU General Public License
   along with this program; if not, write to:

    Free Software Foundation, Inc.
    51 Franklin St, Fifth Floor
    Boston, MA 02110-1301, USA.

On Debian GNU/Linux systems, the complete text of the GNU General Public
License can be found in the /usr/share/common-licenses' directory.

The complete text of the GNU General Public License can also be found online on gnu.org <https://www.gnu.org/licenses/gpl.html>, in Kicksecure virtual machine images in /usr/share/common-licenses/GPL-3 file or on Github <https://github.com/{{project_name_short}}/derivative-maker/blob/master/GPLv3>.
-->
<!--
The Kicksecure Verify_the_images_using_Linux wiki page is forked from the Tails Verify the ISO image using the command line  page, from this exact source <https://git.immerda.ch/?p=amnesia.git;a=blob;f=wiki/src/doc/get/verify_the_iso_image_using_the_command_line.html;hb=ec769a098398fc009b617d9f0aef56310497e518>.
-->
= Introduction =
{{always_verify_signatures_reminder}}

{{Tab
|type=controller
|content=
{{Tab
|title= = OpenPGP =
|image=[[File:GnuPG-Logo.svg|25px]]
|active=true
|addToClass=info-box
|content=

{{gpg_verification_introduction}}

'''1.''' Platform specific. Select your platform.

{{Tab
|type=controller
|linkid=virtualizer_openpgp
|content=
{{Tab
|title={{Headline|h=2|content={{project_name_short}} ISO}}
|image=[[File:Cd-rom-icon.png|25px]]
|type=section
|addToClass=info-box
|active=true
|content=
'''2.''' Import the signing key.

Refer to the more secure, detailed [[Main/Project_Signing_Key|{{project_name_short}} Signing Key]] instructions.

{{signing_key_main}}

'''3.''' Download the cryptographic (OpenPGP) signature corresponding to the image you want to verify.

'''4.''' Save the signature in the same folder as the image.

{{Download_image_and_signature
|text_image=ISO image
|text_signature=ISO signature
|flavor=Xfce
|extension=Intel_AMD64.iso
|after_slash=iso
|version={{VersionNew}}
}}

}} <!-- close tab: {{project_name_short}} OpenPGP key -->

{{Tab
|title={{Headline|h=2|content=VirtualBox}}
|image=[[File:Virtualbox_logo.png|25px]]
|type=section
|addToClass=info-box
|content=

Refer to the more secure, detailed [[Main/Project_Signing_Key|{{project_name_short}} Signing Key]] instructions.

{{signing_key_main}}

'''3.''' Download the cryptographic (OpenPGP) signature corresponding to the image you want to verify.

'''4.''' Save the signature in the same folder as the image.

Select Xfce or CLI version.

{{Tab
|type=controller
|content=
{{Tab
|title={{Headline|h=2|content={{project_name_short}} VirtualBox Xfce}}
|image=[[File:Clipart-gui.svg|25px]]
|addToClass=info-box
|content=

{{Download_image_and_signature
|text_image=VirtualBox Xfce image
|text_signature=VirtualBox Xfce signature
|flavor=Xfce
|extension=Intel_AMD64.ova
|after_slash=ova
|version={{VersionNew}}
}}

}} <!-- close tab: {{project_name_short}} VirtualBox Xfce -->

{{Tab
|title={{Headline|h=2|content={{project_name_short}} VirtualBox CLI}}
|image=[[File:Utilities-terminal.png|25px]]
|addToClass=info-box
|content=

{{Download_image_and_signature
|text_image=VirtualBox CLI image
|text_signature=VirtualBox CLI signature
|flavor=CLI
|extension=Intel_AMD64.ova
|after_slash=ova
|version={{VersionNew}}
}}

}} <!-- close tab: {{project_name_short}} VirtualBox CLI -->
}} <!-- close tab controller: {{project_name_short}} VirtualBox XFCE and CLI -->
}} <!-- close tab: VirtualBox OpenPGP -->

{{Tab
|title={{Headline|h=2|content=KVM}}
|image=[[File:Kvm-new-logo.png|25px]]
|addToClass=info-box
|content=
Refer to the more secure, detailed [[Main/Project_Signing_Key|{{project_name_short}} Signing Key]] instructions.

{{signing_key_main}}

'''3.''' Download the cryptographic (OpenPGP) signature corresponding to the image you want to verify.

'''4.''' Save the signature in the same folder as the image.

Select Xfce or CLI version.

{{Tab
|type=controller
|content=
{{Tab
|title={{Headline|h=2|content={{project_name_short}} KVM Xfce}}
|image=[[File:Clipart-gui.svg|25px]]
|addToClass=info-box
|content=

{{Download_image_and_signature
|text_image=KVM Xfce image
|text_signature=KVM Xfce signature
|flavor=Xfce
|extension=Intel_AMD64.qcow2.libvirt.xz
|after_slash=libvirt
|version={{Version_KVM}}
}}

}} <!-- close tab: {{project_name_short}} VirtualBox Xfce -->

{{Tab
|title={{Headline|h=2|content={{project_name_short}} KVM CLI}}
|image=[[File:Utilities-terminal.png|25px]]
|addToClass=info-box
|content=

{{Download_image_and_signature
|text_image=KVM CLI image
|text_signature=KVM CLI signature
|flavor=CLI
|extension=Intel_AMD64.qcow2.libvirt.xz
|after_slash=libvirt
|version={{Version_KVM}}
}}

}} <!-- close tab: {{project_name_short}} VirtualBox CLI -->
}} <!-- close tab controller: {{project_name_short}} VirtualBox XFCE and CLI -->

}} <!-- close tab: KVM OpenPGP -->

}} <!-- close tab controller: VirtualBox and KVM OpenPGP -->

'''5.''' Change directory.

<pre>
cd [the directory in which you downloaded the image and the signature]
</pre>

'''6.''' Start the cryptographic verification.

This process can take several minutes.

{{Tab
|type=controller
|linkid=virtualizer_openpgp
|content=
{{Tab
|title={{Headline|h=2|content={{project_name_short}} ISO}}
|image=[[File:Cd-rom-icon.png|25px]]
|addToClass=info-box
|content=

{{CodeSelect|code=
gpg --verify-options show-notations --verify {{project_name_short}}-*.Intel_AMD64.iso.asc {{project_name_short}}-*.Intel_AMD64.iso
}}

}} <!-- close tab Verify ISO -->

{{Tab
|title={{Headline|h=2|content=VirtualBox}}
|image=[[File:Virtualbox_logo.png|25px]]
|addToClass=info-box
|content=

{{CodeSelect|code=
gpg --verify-options show-notations --verify {{project_name_short}}-*.ova.asc {{project_name_short}}-*.ova
}}

}} <!-- close tab Verify VirtualBox -->

{{Tab
|title={{Headline|h=2|content=KVM}}
|image=[[File:Kvm-new-logo.png|25px]]
|addToClass=info-box
|content=

{{CodeSelect|code=
gpg --verify-options show-notations --verify {{project_name_short}}-*.libvirt.xz.asc {{project_name_short}}-*.libvirt.xz
}}

}} <!-- close tab: Verify KVM -->

}} <!-- close tab controller: Verify VirtualBox and KVM -->

'''7.''' Check the output of the verification step.

{{GnuPG-Success}}

{{Tab
|type=controller
|linkid=virtualizer_openpgp
|content=
{{Tab
|title={{Headline|h=2|content={{project_name_short}} ISO}}
|image=[[File:Cd-rom-icon.png|25px]]
|type=section
|addToClass=info-box
|active=true
|content=
<pre>
gpg: Good signature
</pre>

}} <!-- close tab: ISO Good Signature -->

{{Tab
|title={{Headline|h=2|content=VirtualBox}}
|image=[[File:Virtualbox_logo.png|25px]]
|addToClass=info-box
|content=
<pre>
gpg: Good signature
</pre>

}} <!-- close tab: VirtualBox Good Signature -->

{{Tab
|title={{Headline|h=2|content=KVM}}
|image=[[File:Kvm-new-logo.png|25px]]
|addToClass=info-box
|content=

<pre>
gpg: Good signature
</pre>

}} <!-- close tab: VirtualBox Good Signature -->

}} <!-- close tab controller: VirtualBox and KVM Good Signature -->

This output might be followed by a warning as follows. 

{{GnuPG-Warning}}

{{gpg_signature_timestamp}}

Example of signature creation timestamp; see below.

<pre>
gpg: Signature made Mon 19 Jan 2023 11:45:41 PM CET using RSA key ID ...
</pre>

{{GnuPG_file_names}}

{{gpg_file_name_notation}}

{{Tab
|type=controller
|linkid=virtualizer_openpgp
|content=
{{Tab
|title={{Headline|h=2|content={{project_name_short}} ISO}}
|image=[[File:Cd-rom-icon.png|25px]]
|type=section
|addToClass=info-box
|active=true
|content=

{{#tag:pre|gpg: Signature notation: file@name={{project_name_short}}-{{VersionNew}}.Intel_AMD64.iso}}
}} <!-- close tab: VirtualBox Signature Notation -->

{{Tab
|title={{Headline|h=2|content=VirtualBox}}
|image=[[File:Virtualbox_logo.png|25px]]
|addToClass=info-box
|content=

{{#tag:pre|gpg: Signature notation: file@name={{project_name_short}}-{{VersionNew}}.Intel_AMD64.ova}}
}} <!-- close tab: VirtualBox Signature Notation -->

{{Tab
|title={{Headline|h=2|content=KVM}}
|image=[[File:Kvm-new-logo.png|25px]]
|addToClass=info-box
|content=
{{#tag:pre|gpg: Signature notation: file@name={{project_name_short}}-{{Version_KVM}}.libvirt.xz}}

}} <!-- close tab: KVM Signature Notation -->
}} <!-- close tab controller: VirtualBox and KVM Signature Notation -->

<u>If the digital software signature verification failed</u>, the output will inform that the signature is bad:

<pre>
gpg: BAD signature
</pre>

{{do_not_continue_on_gpg_verification_errors}}

'''8.''' Done.

Digital software signature verification using OpenPGP has been completed.

{{Template:GnuPG-Troubleshooting}}

}} <!-- close tab: OpenPGP -->

{{Tab
|title= = Signify =
|image=[[File:Signify_Logo.svg|25px]]
|addToClass=info-box
|content=

{{mbox
| type    = notice
| image   = [[File:Ambox_notice.png|40px|alt=Info]]
| text    = Advanced users only!
}}
'''1.''' Select your platform.

{{Tab
|type=controller
|linkid=virtualizer_signify
|content=
{{Tab
|title={{Headline|h=2|content={{project_name_short}} ISO Signify}}
|image=[[File:Cd-rom-icon.png|25px]]
|type=section
|addToClass=info-box
|active=true
|content=
'''2.''' [[Signing_Key#Download_the_signify_Key|Download the signify Key]] and save it as <code>derivative.pub</code>.

{{signing_key_main_signify}}

}} <!-- close tab: VirtualBox Signify -->

{{Tab
|title={{Headline|h=2|content=VirtualBox Signify}}
|image=[[File:Virtualbox_logo.png|25px]]
|type=section
|addToClass=info-box
|active=
|content=
'''2.''' [[Signing_Key#Download_the_signify_Key|Download the signify Key]] and save it as <code>derivative.pub</code>.

{{signing_key_main_signify}}

}} <!-- close tab: VirtualBox Signify -->

{{Tab
|title={{Headline|h=2|content=KVM Signify}}
|image=[[File:Kvm-new-logo.png|25px]]
|addToClass=info-box
|content=
'''2.''' [[Signing_Key#Download_the_signify_Key|Download the signify Key]] and save it as <code>derivative.pub</code>.

{{signing_key_main_signify}}

}} <!-- close tab: KVM Signify -->
}} <!-- close tab controller: VirtualBox and KVM signify tabs -->

'''3.''' Install <code>signify-openbsd</code>.

{{Install Package|
package=signify-openbsd
}}

'''4.''' Note.

[https://forums.whonix.org/t/signify-openbsd/7842/5 It is impossible to <code>signify</code> sign images (<code>.ova</code> / <code>libvirt.tar.xz</code>) directly.] You can only verify the <code>.sha512sums</code> hash sum file using <code>signify-openbsd</code> and then verify the image against the <code>sha512</code> sum.

'''5.''' Download the <code>.sha512sums</code> and <code>.sha512sums.sig</code> files.

'''6.''' Verify the <code>.sha512sums</code> file with <code>signify-openbsd</code>.

{{CodeSelect|code=
signify-openbsd -Vp derivative.pub -m {{project_name_short}}-*.sha512sums
}}

If the signature is valid, it will output:

<pre>
Signature Verified
</pre>

If the signature is invalid, it will output an error.

'''7.''' Compare the hash of the image file with the hash in the <code>.sha512sums</code> file.

{{CodeSelect|code=
sha512sum --strict --check {{project_name_short}}-*.sha512sums
}}

If the hash is correct, it will output:

{{#tag:pre|{{project_name_short}}-Xfce-{{VersionNew}}.ova: OK}}

{{do_not_continue_on_gpg_verification_errors}}

'''8.''' Done.

Digital signature verification using signify has been completed.

If you are using signify for software signature verification, please consider making a report in the [https://forums.whonix.org/t/signify-openbsd/7842 signify-openbsd forum thread]. This will help developers decide whether to continue supporting this method or deprecate it.

Forum discussion: [https://forums.whonix.org/t/signify-openbsd/7842 signify-openbsd].

}} <!-- close tab: Signify -->
}} <!-- closing tabs: OpenPGP and Signify -->

= Footnotes =
{{reflist|close=1}}

= License =
{{License_Amnesia|{{FULLPAGENAME}}}}

{{Footer}}

[[Category:Documentation]]
[[Category:MultiWiki]]