Question about verifying the ISO

Ask Fedora
1

Hi,

I just wanted to check a small detail about verifying the iso.
I have downloaded the checksum and pgp/gpg files.
but as per

I have run
gpg --with-fingerprint --show-keys --keyid-format long fedora.gpg

Comparing the output to whats listed on the site, the fingerprint should be
ID:rsa4096/31645531 2024-08-10
Fingerprint:
C6E7F081CF80E13146676E88829B606631645531
DNS Record:72dec291ea5c80f07dca832be132f5c6cb6d43713ec4843dff82d7ee._openpgpkey.fedoraproject.org

For me the id does not match at all, but the fingerprint does. No dns record is shown for me, Is that expected?

Thanks

2

Here are the relevant DNS records:

3

Hi,

thanks for your reply. I am not entirely sure what your referring to, if you could clarify?

4

This is a method for distributing PGP keys:

> dig +short -t OPENPGPKEY -q \
72dec291ea5c80f07dca832be132f5c6cb6d43713ec4843dff82d7ee.\
_openpgpkey.fedoraproject.org | base64 -d -i | gpg --show-key
pub   rsa4096 2024-08-10 [SCE]
      C6E7F081CF80E13146676E88829B606631645531
uid                      Fedora (43) <fedora-43-primary@fedoraproject.org>
1 Like
5

Yes, that is expected. The DNS record is just provided as another means of fetching the key for verification.

You could, for example, use a dig command like the following to query the DNS record.

dig -t openpgpkey 72dec291ea5c80f07dca832be132f5c6cb6d43713ec4843dff82d7ee._openpgpkey.fedoraproject.org +short | base64 -id | gpg --show-keys

I think the idea is that providing multiple sources for retrieving the keys should make it more difficult for a hacker to fake all the sources and provide false data.

As for the difference in the ID string, that needs to be fixed on the website. The website is showing the short form of the ID (just the last 8 hex digits of the fingerprint).

Edit: Valdislav beat me to figuring out the dig command. :slightly_smiling_face:

1 Like
6

Thanks for clarifying,

I did not even notice the id matched only the last 8 digits.
That makes sense to have other means to check the certs.

Thanks

1 Like
7

Ah I see, so its another way of fetching the signature/cert. It is just how it all comes together, fair enough.

Thanks