Should we use gpg signatures also for our ISO images? #188

New issue

Closed

opened 2016-02-21 22:36:34 +00:00 by philm · 9 comments

philm commented

2016-02-21 22:36:34 +00:00

(Migrated from gitlab2.manjaro.org)

Created by: philmmanjaro

Hi team,

should we use also gpg signatures for our ISO images? Seems some are more sensitive now ...

*Created by: philmmanjaro* Hi team, should we use also gpg signatures for our ISO images? Seems some are [more sensitive](http://blog.linuxmint.com/?p=2994) now ...

oberon commented

2016-02-22 15:53:13 +00:00

(Migrated from gitlab2.manjaro.org)

I think that's a great idea. Works really simple once you have your gpg keys set up...
https://www.gnupg.org/gph/en/manual/x135.html

$ gpg --output manjaro-cinnamon-minimal-16.02-x86_64.iso --decrypt manjaro-cinnamon-minimal-16.02-x86_64.iso.sig
gpg: assuming signed data in 'manjaro-cinnamon-minimal-16.02-x86_64.iso'
gpg: Signature made Mon 22 Feb 2016 16:39:00 CET using RSA key ID 663CA268
gpg: Good signature from "Bernhard Landauer <oberon@manjaro.org>" [ultimate]

I think that's a great idea. Works really simple once you have your gpg keys set up... https://www.gnupg.org/gph/en/manual/x135.html ``` $ gpg --output manjaro-cinnamon-minimal-16.02-x86_64.iso --decrypt manjaro-cinnamon-minimal-16.02-x86_64.iso.sig gpg: assuming signed data in 'manjaro-cinnamon-minimal-16.02-x86_64.iso' gpg: Signature made Mon 22 Feb 2016 16:39:00 CET using RSA key ID 663CA268 gpg: Good signature from "Bernhard Landauer <oberon@manjaro.org>" [ultimate] ```

philm commented

2016-02-22 16:24:06 +00:00

(Migrated from gitlab2.manjaro.org)

Created by: udeved

We should add a counterpart to signpkg, signiso.

*Created by: udeved* We should add a counterpart to signpkg, signiso.

philm commented

2016-02-22 18:35:17 +00:00

(Migrated from gitlab2.manjaro.org)

Created by: udeved

==> Creating [sha256] sum ...
  -> sha256 sum: fcc199eff684ecf4fc75675c784e378c9d6461781f4bdca0d8fca7624c9f5d5a  manjaro-lxqt-minimal-openrc-16.02-x86_64.iso
==> Done [sha256] sum
==> Signing iso /build/manjaro-tools/iso/minimal/lxqt-minimal/16.02/x86_64/manjaro-lxqt-minimal-openrc-16.02-x86_64.iso with key

*Created by: udeved* ``` ==> Creating [sha256] sum ... -> sha256 sum: fcc199eff684ecf4fc75675c784e378c9d6461781f4bdca0d8fca7624c9f5d5a manjaro-lxqt-minimal-openrc-16.02-x86_64.iso ==> Done [sha256] sum ==> Signing iso /build/manjaro-tools/iso/minimal/lxqt-minimal/16.02/x86_64/manjaro-lxqt-minimal-openrc-16.02-x86_64.iso with key ```

oberon commented

2016-02-22 18:36:58 +00:00

(Migrated from gitlab2.manjaro.org)

Awesome! 😎 Thank you!!

Awesome! :sunglasses: Thank you!!

philm commented

2016-02-22 18:55:41 +00:00

(Migrated from gitlab2.manjaro.org)

Created by: philmmanjaro

We should communicate how to setup the gpg-keyring for manjaro-tools.

*Created by: philmmanjaro* We should communicate how to setup the **gpg-keyring** for **manjaro-tools**.

philm commented