Fedora 41 Labs x86_64 iso CHECKSUM-File is not signed

Ask Fedora
,
1

The checksum file for Fedoa 41 Lab seems to be incomplete. The CHECKSUM-File looks like it is not signed. I am missing the areas

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

-----BEGIN PGP SIGNATURE-----
SIGNATURE
-----END PGP SIGNATURE-----

The Fedora-Labs-41-1.4-x86_64-CHECKSUM file is on the web site:
https://mirrors.dotsrc.org/fedora-alt/releases/41/Labs/x86_64/iso/Fedora-Labs-41-1.4-x86_64-CHECKSUM

2

If you trust the *.fedoraproject.org certificate issued by Red Hat (and you trust your browser to validate it correctly), then you can rely on the checksums downloaded from here: https://dl.fedoraproject.org/pub/alt/releases/41/Labs/x86_64/iso/Fedora-Labs-41-1.4-x86_64-CHECKSUM

Otherwise, report the problem to the Fedora Infra team here: Issues - fedora-infrastructure - Pagure.io (when pagure.io comes back online :confused:)

3

Hi @glb Gregory,
the point is, that is not possible to verfiy the CHECKSUM-File, if there is no signature included in the file.

Normaly the signature is always included (for example f39, f40 Lab Checksum file), but not this time for Lab f41 ISO files.

For example:
https://dl.fedoraproject.org/pub/alt/releases/40/Labs/x86_64/iso/Fedora-Labs-40-1.14-x86_64-CHECKSUM

https://dl.fedoraproject.org/pub/alt/releases/39/Labs/x86_64/iso/Fedora-Labs-39-1.5-x86_64-CHECKSUM

1 Like