Get Whonix OpenPGP signing key. Verify Whonix Downloads, APT Repository and/or Source Code.

Introduction[edit]

Since all Whonix releases are signed with the same key, it is unnecessary to verify the key every time a new release is announced. Trust in the key might gradually increase over time, but cryptographic signatures must still be verified every time a new release is downloaded.

This page is strongly related to the Placing Trust in Whonix page.

Digital signatures are a tool enhancing download security. They are commonly used across the internet and nothing special to worry about.
Optional, not required: Digital signatures are optional and not mandatory for using Whonix, but an extra security measure for advanced users. If you've never used them before, it might be overwhelming to look into them at this stage. Just ignore them for now.
Learn more: Curious? If you are interested in becoming more familiar with advanced computer security concepts, you can learn more about digital signatures here digital software signatures.

Download the OpenPGP Key[edit]

GnuPG logo

Optional: Complete the steps below if unfamiliar with GnuPG or if they haven't already been performed.

Have GnuPG initialize your user data folder. ^[1]

gpg --fingerprint

Set warning free permissions.

chmod --recursive og-rwx ~/.gnupg

Select your operating system.

Windows, macOS, Linux

1. Securely download Patrick Schleizer's (adrelanos') OpenPGP key. ^[2] ^[3]

Download Whonix OpenPGP Key

2. Store the key as derivative.asc.

3. Check fingerprints/owners without importing anything.

gpg --keyid-format long --import --import-options show-only --with-fingerprint derivative.asc

4. Verify the output.

The most important check is confirming the key fingerprint exactly matches the output below. ^[4]

      Key fingerprint = 916B 8D99 C38E AF5E 8ADC  7A2A 8D66 066A 2EEA CCDA

The message gpg: key 8D66066A2EEACCDA: 104 signatures not checked due to missing keys is related to the The OpenPGP Web of Trust. Advanced users can learn more about this below.

Warning:

Do not continue if the fingerprint does not match! This risks using infected or erroneous files! The whole point of verification is to confirm file integrity.

5. Configure the trust level for the GPG key.

Optional. ^[5]

echo "916B8D99C38EAF5E8ADC7A2A8D66066A2EEACCDA:6:" | gpg --import-ownertrust

The output should create trustdb.

gpg: /home/user/.gnupg/trustdb.gpg: trustdb created
gpg: inserting ownertrust of 6

6. Import the key.

gpg --import derivative.asc

The output should include the key was imported.

gpg: key 8D66066A2EEACCDA: public key "Patrick Schleizer <adrelanos@kicksecure.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: next trustdb check due at 2026-01-23

If the Whonix signing key was already imported in the past, the output should include the key is unchanged.

gpg: Total number processed: 1
gpg:              unchanged: 1

7. Web of trust.

Advanced users can check Web of Trust further below for better security.

Kicksecure or Whonix

1. Configure the trust level for the GPG key.

Optional. ^[5]

echo "916B8D99C38EAF5E8ADC7A2A8D66066A2EEACCDA:6:" | gpg --import-ownertrust

The output should create trustdb.

gpg: /home/user/.gnupg/trustdb.gpg: trustdb created
gpg: inserting ownertrust of 6

2. Import the key.

Since the key is already available in Kicksecure or Whonix, importing the key is simpler than for other operating systems.

gpg --import /usr/share/keyrings/derivative.asc

The message gpg: key 8D66066A2EEACCDA: 104 signatures not checked due to missing keys is related to the The OpenPGP Web of Trust. Advanced users can learn more about this below.

3. Skip a few steps.

Steps 4. to 7. (which would be required for Windows, macOS and other Linux) can be skipped here. Proceed to step 8. below.

Debian and Derivatives

1. Install extrepo-offline-data.

Because it contains the signing key.

Install package(s) extrepo-offline-data following these instructions

Platform specific notice.

Non-Qubes-Whonix: No special notice.
Qubes-Whonix: In Template.

Update the package lists and upgrade the system .

sudo apt update && sudo apt full-upgrade

Install the extrepo-offline-data package(s).

Using apt command line --no-install-recommends option is in most cases optional.

sudo apt install --no-install-recommends extrepo-offline-data

Platform specific notice.

Non-Qubes-Whonix: No special notice.
Qubes-Whonix: Shut down Template and restart App Qubes based on it as per Qubes Template Modification .

Done.

The procedure of installing package(s) extrepo-offline-data is complete.

2. Configure the trust level for the GPG key.

Optional. ^[5]

echo "916B8D99C38EAF5E8ADC7A2A8D66066A2EEACCDA:6:" | gpg --import-ownertrust

The output should create trustdb.

gpg: /home/user/.gnupg/trustdb.gpg: trustdb created
gpg: inserting ownertrust of 6

3. Import the key.

Thanks to the extrepo-offline-data package, the key is already available on the local file system and can be imported into the user's keyring. ^[6]

gpg --import /usr/share/extrepo/offline-data/debian/bullseye/whonix.asc

4. Skip a few steps.

Proceed to step 8. below.

8. Complete the Whonix verification steps.

If verifying Whonix images, navigate to the relevant verification page below to finish the process:

OpenPGP Key Features[edit]

sign/verify Whonix images: yes
sending encrypted e-mails to Whonix developer Patrick: yes

Advanced Users[edit]

OpenPGP Web of Trust[edit]

A few people have signed Patrick Schleizer's (adrelanos') OpenPGP key in The OpenPGP Web of Trust.

Jan Dittberner ^[7] (Debian Developer) ^[8] signed Patrick's key. So did intrigeri (Tails developer, Debian Developer); Peter Palfrader (Debian Developer); Richard King; and Michael Carbone (accessnow.org).

Users relying on Debian or one of the many Debian derivatives (like Ubuntu) already trust apt, the APT repository of the relevant distribution. This means the Debian keyring can be installed as a trusted source for obtaining Jan's, intrigeri's or Peter's key, to check their signature on Patrick's key.

1. Update the package lists.

sudo apt update

2. Install the Debian keyring.

sudo apt install debian-keyring

3. Extract a signer's key from the Debian keyring and import it into your own keyring.

Here is an example using Jan's key.

gpg --no-default-keyring --keyring /usr/share/keyrings/debian-keyring.gpg --armor --export B2FF1D95CE8F7A22DF4CF09BA73E0055558FB8DD | gpg --import

4. Optional: Try to establish a better trust path to the signer by checking signatures on the signer's key.

Check signatures on Patrick's key.

gpg --check-sigs 916B8D99C38EAF5E8ADC7A2A8D66066A2EEACCDA

The output of the above command should show signatures on Patrick's key, which should include the signer's signature.

Download the signify Key[edit]

Advanced users only!

^[9]

Download Whonix signify Key

License[edit]

Whonix Main/Project Signing Key wiki page Copyright (C) Amnesia <amnesia at boum dot org>
Whonix Main/Project Signing Key wiki page Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <adrelanos(at)whonix.org (Replace (at) with @.)Please DO NOT use e-mail for one of the following reasons: Private Contact: Please avoid e-mail whenever possible. (Private Communications Policy) User Support Questions: No. (See Support.) Leaks Submissions: No. (No Leaks Policy) Sponsored posts: No. Paid links: No. SEO reviews: No. >
This program comes with ABSOLUTELY NO WARRANTY; for details see the wiki source code.
This is free software, and you are welcome to redistribute it under certain conditions; see the wiki source code for details.

Footnotes[edit]

↑ This will fix eventual gpg: WARNING: unsafe ownership warnings.
↑ curl --tlsv1.3 --proto =https --max-time 180 --output derivative.asc https://www.whonix.org/keys/derivative.asc
↑
↑ Minor changes in the output such as new uids (email addresses) or newer expiration dates are inconsequential.
↑ ^5.0 ^5.1 ^5.2
The trust level will be increased to ultimately. (This is because the command contains trust level ":6:".)
The purpose of this command is:
- A) to avoid the following warning when importing the key. And,
```
gpg: no ultimately trusted keys found
```
- B) to avoid the following warning when verifying a file signed by that key.
```
gpg: WARNING: This key is not certified with a trusted signature! 
gpg: There is no indication that the signature belongs to the owner.
```
Advanced users are free to skip this step or use a different GPG trust level.
↑
Note to wiki editors:
- Hardcoded to whonix.asc.
- This is because at the time kicksecure.asc was not yet included in package extrepo-offline-data.
- https://packages.debian.org/bullseye-backports/all/extrepo-offline-data/filelist
↑ https://jan.dittberner.info/
↑ https://qa.debian.org/developer.php?login=Jan+Dittberner

↑

Whonix

The most watertight privacy operating system in the world.

Dark mode

Supported by Power Up Privacy

Whonix is proudly supported until 2025 by Power Up Privacy, a privacy advocacy group that seeks to supercharge privacy projects with resources so they can complete their mission of making our world a better place. (Strictly subject to our sponsorship policy.)

At Whonix we value freedom and trust, supporting Open Source and Freedom Software

By using this website, you acknowledge you have read, understood, and agree to be bound by these agreements: Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint

2012- 2024 ENCRYPTED SUPPORT LP

Your support makes
all the difference!

We believe security software like Whonix needs to remain open source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!

[1] This will fix eventual gpg: WARNING: unsafe ownership warnings.

[2] url --tlsv1.3 --proto =https --max-time 180 --output derivative.asc https://www.whonix.org/keys/derivative.asc

[3] 
https://www.whonix.org/keys/derivative.asc

https://github.com/Whonix/qubes-template-whonix/blob/master/keys/whonix-developer-patrick.asc

https://github.com/QubesOS/qubes-builder/blob/master/keys/916B8D99C38EAF5E8ADC7A2A8D66066A2EEACCDA.asc

[4] ttps://www.whonix.org/keys/derivative.asc

[5] ttps://github.com/Whonix/qubes-template-whonix/blob/master/keys/whonix-developer-patrick.asc

[6] ttps://github.com/QubesOS/qubes-builder/blob/master/keys/916B8D99C38EAF5E8ADC7A2A8D66066A2EEACCDA.asc

[4] Minor changes in the output such as new uids (email addresses) or newer expiration dates are inconsequential.

[gpg-import-ownertrust-5] 5.0 ^5.1 ^5.2 The trust level will be increased to ultimately. (This is because the command contains trust level ":6:".)
The purpose of this command is:
A) to avoid the following warning when importing the key. And,

gpg: no ultimately trusted keys found

B) to avoid the following warning when verifying a file signed by that key.

gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner.

Advanced users are free to skip this step or use a different GPG trust level.

[9] A) to avoid the following warning when importing the key. And,

[10] B) to avoid the following warning when verifying a file signed by that key.

[6] Note to wiki editors:
Hardcoded to whonix.asc.

This is because at the time kicksecure.asc was not yet included in package extrepo-offline-data.

https://packages.debian.org/bullseye-backports/all/extrepo-offline-data/filelist

[12] Hardcoded to whonix.asc.

[13] This is because at the time kicksecure.asc was not yet included in package extrepo-offline-data.

[14] ttps://packages.debian.org/bullseye-backports/all/extrepo-offline-data/filelist

[7] ttps://jan.dittberner.info/

[8] ttps://qa.debian.org/developer.php?login=Jan+Dittberner

[9] 
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 untrusted comment: Patrick Schleizer adrelanos@whonix.org signify public key RWQ6KRormNEETq+M8IysxRe/HAWlqZRlO8u7ACIiv5poAW0ztsirOjCQ -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEEbpebKKbzfEO+MK+hy41Qu3e7PEgFAmInQmhfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDZF OTc5QjI4QTZGMzdDNDNCRTMwQUZBMUNCOEQ1MEJCNzdCQjNDNDgACgkQy41Qu3e7 PEhSyg/+J2R20mA5xVDT0FlZrtHXnNkZzg48FbSteak6utpmd9HGZlTxlEA3ou8z MlDGDHAYgpfe74suqQl2dEql6Mio4YuUou8GW2aEJ+AVa5jRlHMj4H9alTGmUtok UdaCVVQQO/FCE3y1N00TmuxyDghP9dm1cT8mho0P0RbVoqQyMTDIzLiXCa5aPwu/ nyBGwxdVPuGNZ0WYJfKXLRdb/3q2xprYDQOTehLDHnUVins2kKnsbwVTBY4u4575 KQfOwZD176oQZlZOuw6qxhOd0RWF33TMnQXKPjmaTpTjtsbKOascNBqnjDZbDNhl MSmRKvPZ4bi3IbpSsZdRiwXEOEnyeRhqlwhGX8UecU5e31iMRx8vJDA3u2oSQnrZ l8vnFvnnkGe3/COMAAlIEH+bFofFui3QMWYzX5A2g4jHzfgdrYJcNEZmaeptIRJj qs2eteI7FFt/hQaEZimN6TES0o91+JDLQPHDkEbbE8V9qOxUE6+pqLnRmr/uAMbc 3WA73dphJQfBHQOT2k+ByrrZ/h18x5YrMhvr8HB0f8ejU9YiWG/YnbPvvPNuSdQb 1xSaWmWrXpFgDMOJuG0H7uQi+IcZgQj+JsPaMXTZ6ehHyAr50c61TBoG/UzOXTJg YlD+NW0yh7b2XBXsL4Xj0X1lrHBxFGHiaM7zC//pIPKTG7kfyJ4= =n5bK -----END PGP SIGNATURE-----

[1]

[2]

[3]

[4]

[5]

[6]

[7]

[8]

[9]

Download the Whonix Signing Key

Contents

Introduction[edit]

Download the OpenPGP Key[edit]

Windows, macOS, Linux

Kicksecure or Whonix

Debian and Derivatives

OpenPGP Key Features[edit]

Advanced Users[edit]

OpenPGP Web of Trust[edit]

Download the signify Key[edit]

Further Reading[edit]

Troubleshooting[edit]

See Also[edit]

License[edit]

Footnotes[edit]

Navigation menu

Download the Whonix Signing Key

Introduction[edit]

Download the OpenPGP Key[edit]

Windows, macOS, Linux

Kicksecure or Whonix

Debian and Derivatives

OpenPGP Key Features[edit]

Advanced Users[edit]

OpenPGP Web of Trust[edit]

Download the signify Key[edit]

Further Reading[edit]

Troubleshooting[edit]

See Also[edit]

License[edit]

Footnotes[edit]

Navigation menu

Search