How to verify live images

1

Hi,
I found:

LiveMedia.html#deliverables

I downloaded:
AlmaLinux-9.0-x86_64-Live-GNOME.iso
CHECKSUM
CHECKSUM.asc

I dont see any instructions to verify the download so I tried the instructions in:

release-notes/9.0.html

I did:
Download and import the AlmaLinux public key:

$ wget https://repo.almalinux.org/almalinux/RPM-GPG-KEY-AlmaLinux-9
$ gpg --import RPM-GPG-KEY-AlmaLinux-9

When I do:
gpg --verify CHECKSUM

I get:
gpg: no valid OpenPGP data found.
gpg: the signature could not be verified.
Please remember that the signature file (.sig or .asc)
should be the first file given on the command line.

Please help

2

some info here: Generic Cloud (cloud-init) | AlmaLinux Wiki

bit confusing as there’s versioned keys and not one for the full dvd1 iso only cloud/live.

basically:

curl -s https://repo.almalinux.org/almalinux/RPM-GPG-KEY-AlmaLinux-9 -O
curl -s https://repo.almalinux.org/almalinux/9.0/live/x86_64/CHECKSUM -O
curl -s https://repo.almalinux.org/almalinux/9.0/live/x86_64/CHECKSUM.asc -O

gpg --with-subkey-fingerprints RPM-GPG-KEY-AlmaLinux
gpg --import RPM-GPG-KEY-AlmaLinux
gpg --verify CHECKSUM.asc CHECKSUM
sha256sum -c CHECKSUM
1 Like
3

@sej7278
Thanks for your help :slight_smile:

1 Like