Need help with Kleopatra's key verification process for a linux distro

[maninthemiddle]

I am using Kleopatra is verify my linux distro.iso file

Where am I supposed to find the correct verification key for the linux distro that I downloaded?

How am I supposed to know that I have the right key?

Neither OPENAI or Google AI mentions a particular website that I should find them at.

I have been given both of these from OPENAI and Google AI

Key ID: 0x46181433FBB75451 -- C598 6B4F 1257 FFA8 6632 CBA7 4618 1433 FBB7 5451

Key ID: 0xD94AA3F0EFE21092 -- 8439 38DF 228D 22F7 B374 2BC0 D94A A3F0 EFE2 1092

Likewise when I use powersehll to use
PS C:\Users\blahblahblah> gpg --keyid-format long --keyserver hkp://keyserver.ubuntu.com --recv-keys "C598 6B4F 1257 FFA8 6632 CBA7 4618 1433 FBB7 5451"
gpg: key 46181433FBB75451: public key "Ubuntu CD Image Automatic Signing Key <[email protected]>" imported
gpg: Total number processed: 1
gpg: imported: 1

PS C:\Users\blahblahblah> gpg --keyid-format long --keyserver hkp://keyserver.ubuntu.com --recv-keys "8439 38DF 228D 22F7 B374 2BC0 D94A A3F0 EFE2 1092"
gpg: key D94AA3F0EFE21092: public key "Ubuntu CD Image Automatic Signing Key (2012) <[email protected]>" imported
gpg: Total number processed: 1
gpg: imported: 1

Meanwhile Kleopatra says neither of those keys have a certified status and both are over a decade old.

Which means neither would work to begin with seeing how my linux distro is not that old.

 

[Condobloke]

G'day maninthemiddle, Welcome to linux.org

I have not encountered Kleopatra before, but as far as I can tell it is not suited to verifying a checksum.

The below will give a much easier time:

How to check the integrity of the iso

Easy tips, tweaks and tricks for Linux Mint and Ubuntu, both for beginners and for advanced users. Complete starter's guide with simple how-to's.

easylinuxtipsproject.blogspot.com

 

[maninthemiddle]

Sorry I should have clarified.
I already verifies the checksum.

I am trying to verify the signature of the of the gpg file.

Verify the SHA256SUMS.gpg​

1. In Kleopatra, click File → Decrypt/Verify…
2. Select SHA256SUMS.gpg
3. Make sure the SHA256SUMS file is in the same folder (same directory level).

If it works, you’ll see something like:

Good signature from "Ubuntu CD Image Automatic Signing Key <[email protected]>"

That means the checksum list is authentic.

If you still see:

“The data could not be verified”

Then one of these is true:

• SHA256SUMS and .gpg are from different releases (e.g., 24.04 vs 24.04.3).
• The key wasn’t imported properly.
• Kleopatra can’t find the SHA256SUMS file (they must be side by side).

 

[Condobloke]

I am still of the opinion that Kleopatra is the wrong tool for the job

Kleopatra

Email Encryption

www.openpgp.org

Use the link I provided.
https://easylinuxtipsproject.blogspot.com/p/iso-check.html

It is straightforward, and is meant to be used for that job.

 

[maninthemiddle]

okay thankx

 

[CaffeineAddict]

I am trying to verify the signature of the of the gpg file.

Meanwhile Kleopatra says neither of those keys have a certified status and both are over a decade old.

They gpg key you downloaded has no expiration date set, this means it is valid for ever, or until its owner revokes it.

You first need to certify ubuntu key, to do this you need your own self signed certificate (can be created in Kleopatra or with gpg command), then in Kleopatra right click on imported ubuntu key and click "certify", then from drop down select your key with whom to certify.

"Invalid signature" red text from your screenshot means either the ISO was not signed with that key or the ISO is corrupt.

To avoid this make sure you download correct ubuntu signing key.
Here are steps:

Ubuntu image integrity verification

You must manually verify the authenticity of Ubuntu installation images, as standard HTTP or FTP clients (such as browsers) don’t have this capability. This is important even if you use a secure ch...

documentation.ubuntu.com

And here is where you can download a key with correct ISO image:

Ubuntu Releases

Select your version and on next page you should find the key.
Import it into Kleopatra and certify it with your key.

 

[Condobloke]

@maninthemiddle, I stand corrected. Apparently Kleopatra can be used successfully.

You may still find the link I left for you easier to work with.

Good Luck