Hi everyone. I’m on Fedora 44 Workstation and I’m trying to install VeraCrypt from their official website. However, when following their instructions about importing the VeraCrypt GPG Public Key using ‘sudo rpm --import’, the key is automatically imported without showing the key’s fingerprint and asking for confirmation before importing. Their instructions clearly says that “This process will display the key’s fingerprint and ask for your confirmation before adding the key”. Using ‘rpm -qi’ shows information of the already imported gpg-pubkey, but doesn’t show the fingerprint. Is this normal? Is there another way to show the fingerprint? Can it be dangerous? Thanks in advance.
I believe you can use rpmkeys --list to show the pubkeys and their fingerprints.
It’s definitely a good idea to check when advised to.
If the fingerprint matches you can be sure you have the correct key. Presumably the installer will take care of verifying the actual package, but you might want to verify checksums too if available.