Verify Whonix Images Software Signatures

Whonix ®

Download

Windows Linux Mac VirtualBox KVM Qubes USB ISO (coming soon) More options Source Code

About

Overview Features Whonix vs VPNs Why Open Source? Project Activities Contributors Mission & Vision

Docs

Documentation FAQ Troubleshooting

Community

Forums Contribute

Support

Self Support First Policy Search Engines, Docs and AI Support (Limited) Reporting Bugs Contact (Restricted)

Tools Upload file Special pages Recent changes Print Version Page meta What links here Related changes Page information

Page Read Edit History Move Protection Unwatch Watch Delete Purge

User Preferences Watchlist Contributions Logout Create account Login

Donate

Download image verification instructions for Non-Qubes-Whonix with OpenPGP and Signify.

• Digital signatures are a tool enhancing download security. They are commonly used across the internet and nothing special to worry about.
• Optional, not required: Digital signatures are optional and not mandatory for using Whonix, but an extra security measure for advanced users. If you've never used them before, it might be overwhelming to look into them at this stage. Just ignore them for now.
• Learn more: Curious? If you are interested in becoming more familiar with advanced computer security concepts, you can learn more about digital signatures here digital software signatures.

OpenPGP Signature

Qubes

Qubes-Whonix^™ templates are automatically verified when qubes-dom0-update downloads and installs them; manual user verification is unnecessary.

VirtualBox

Steps to verify the virtual machine images depend on the operating system in use:

• Linux
• Windows using Gpg4win
• macOS using GPGTools

Also see: VirtualBox Appliance is not signed Error Message.

KVM

Refer to the KVM Linux on the Command Line instructions.

Windows Installer

The Whonix Windows Installer is currently unavailable. (Verify the Whonix Windows Installer)

Signify Signatures

Advanced users only!

It is impossible to signify sign images (.ova / libvirt.tar.xz) directly. You can only verify the .sha512sums hash sum file using signify-openbsd and then verify the image against the sha512 sum.

1. Download the signify Key and save it as keyname.pub.

Download Whonix signify Key

2. Install signify-openbsd.

Install package(s) signify-openbsd following these instructions

1 Platform specific notice.

• Non-Qubes-Whonix: No special notice.
• Qubes-Whonix: In Template.

2 Update the package lists and upgrade the system .

sudo apt update && sudo apt full-upgrade

3 Install the signify-openbsd package(s).

Using apt command line --no-install-recommends option is in most cases optional.

sudo apt install --no-install-recommends signify-openbsd

4 Platform specific notice.

• Non-Qubes-Whonix: No special notice.
• Qubes-Whonix: Shut down Template and restart App Qubes based on it as per Qubes Template Modification .

5 Done.

The procedure of installing package(s) signify-openbsd is complete.

3. Download the .sha512sums and .sha512sums.sig files.

4. Verify the .sha512sums file with signify-openbsd.

signify-openbsd -Vp keyname.pub -m Whonix-*.sha512sums

If the file is correct, it will output:

Signature Verified

If the file is not correct, it will output an error.

5. Compare the hash of the image file with the hash in the .sha512sums file.

sha512sum -c Whonix-*.sha512sums

If the file is correct, it will output:

Whonix-Xfce-17.2.3.7.ova: OK

Do not continue if verification fails! This risks using infected or erroneous files! The whole point of verification is to confirm file integrity. This page is strongly related to the pages Placing Trust in Whonix and Verifying Software Signatures.

If you are using signify for software signature verification, please consider making a report in the signify-openbsd forum thread. This will help developers decide whether to continue supporting this method or deprecate it.

Table: Whonix VirtualBox Files

Whonix Version	Files
Whonix VirtualBox CLI	https://download.whonix.org/ova/17.2.3.7/Whonix-CLI-17.2.3.7.ova https://download.whonix.org/ova/17.2.3.7/Whonix-CLI-17.2.3.7.sha512sums https://download.whonix.org/ova/17.2.3.7/Whonix-CLI-17.2.3.7.sha512sums.sig
Whonix VirtualBox Xfce	https://download.whonix.org/ova/17.2.3.7/Whonix-Xfce-17.2.3.7.ova https://download.whonix.org/ova/17.2.3.7/Whonix-Xfce-17.2.3.7.sha512sums https://download.whonix.org/ova/17.2.3.7/Whonix-Xfce-17.2.3.7.sha512sums.sig

Forum discussion: signify-openbsd.

Codecrypt Signatures

Codecrypt signatures are not yet available, but are planned long term.

Volunteer contributions are happily considered! If you were to contribute codecrypt signature creation to the Whonix dm-prepare-release script, then this feature could be provided much sooner.

If you would like to use codecrypt for software signature verification, please consider making a report in the codecrypt forum thread. This method might be supported sooner if there is sufficient interest.

Forum discussion:
use codecrypt to sign releases.

See Also

• Download the Whonix Signing Key
• Verifying Software Signatures
• Placing Trust in Whonix
• OpenPGP key distribution strategies

Whonix The most watertight privacy operating system in the world.

Dark mode

Follow us on social media

Supported by Power Up Privacy

Whonix is proudly supported until 2025 by Power Up Privacy, a privacy advocacy group that seeks to supercharge privacy projects with resources so they can complete their mission of making our world a better place. (Strictly subject to our sponsorship policy.)

At Whonix we value freedom and trust, supporting Open Source and Freedom Software

By using this website, you acknowledge you have read, understood, and agree to be bound by these agreements: Terms of Service, Privacy Policy, Cookie Policy, E-Sign Consent, DMCA, Imprint 2012- 2024 ENCRYPTED SUPPORT LP

Your support makes
all the difference!

We believe security software like Whonix needs to remain open source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!