<!--
Copyright:

   Copyright (C) Amnesia <amnesia at boum dot org>
   Copyright (C) 2012 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
   the Free Software Foundation; either version 3 of the License, or
   (at your option) any later version.

   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.

   You should have received a copy of the GNU General Public License
   along with this program; if not, write to:

    Free Software Foundation, Inc.
    51 Franklin St, Fifth Floor
    Boston, MA 02110-1301, USA.

On Debian GNU/Linux systems, the complete text of the GNU General Public
License can be found in the /usr/share/common-licenses' directory.

The complete text of the GNU General Public License can also be found online on gnu.org <https://www.gnu.org/licenses/gpl.html>, in {{project_name_long}} virtual machine images in /usr/share/common-licenses/GPL-3 file or on Github <{{Github_link|repo=derivative-maker|path=/blob/master/GPLv3}}>.
-->
<!--
This wiki page is a fork of the Tails Trusting Tails signing key page, from this exact source <https://git.immerda.ch/?p=amnesia.git;a=blob;f=wiki/src/doc/get/trusting_tails_signing_key.mdwn;hb=63b68fb4970361131cbd1713b40521244e88c204>.
-->
{{Header}}
{{Title|title=
Download the {{project_name_short}} Signing Key
}}
{{#seo:
|description=Get {{project_name_short}} OpenPGP signing key. Verify {{project_name_short}} Downloads, APT Repository and/or Source Code.
|image=Keysigning.jpg
}}
[[File:Keysigning.jpg|thumb]]
{{intro|
Get {{project_name_short}} OpenPGP signing key. Verify {{project_name_short}} Downloads, APT Repository and/or Source Code.
}}
= Introduction =

Since all {{project_name_short}} releases are signed with the same key, it is unnecessary to verify the key every time a new release is announced. Trust in the key might gradually increase over time, but cryptographic signatures must still be verified every time a new release is downloaded.

This page is strongly related to the [[Trust|Placing Trust in {{project_name_short}}]] page.

{{always_verify_signatures_reminder}}

{{Anchor|Download the Key}}

= Download the OpenPGP Key =
<!--
EDITORS NOTES:
- Not recommending 'scurl': Because these instructions are done on the host. Perhaps by users that are not yet {{project_name_short}} users. 'scurl' is not available to them.
- Not recommending curl: Because it may not be installed on their host. Perhaps Windows users are looking at these instructions.
- Instructions target regular users. Not from-source-builders.
-->
[[File:GnuPG-Logo.svg|thumb|100px|GnuPG logo]]

{{Box|text=
{{gpg_init}}
}}

{{Box|text=
{{IconSet|h1|1}} Select your operating system.

{{Tab
|type=controller
|content=
{{Tab
|title= == Windows, macOS, Linux ==
|image=[[File:Any12312.png|25px]]
|content=
{{IconSet|h1|2}} [[Secure_Downloads|Securely]] download [[Patrick Schleizer]]'s (adrelanos') [[OpenPGP]] key. <ref>
<!--
WIKI EDITOR NOTE:

Wiki templates limitations. Wiki wide update of [[Template:Curl_Secure]] to --tlsv1.3 would break too much. Hence, not using {{Curl_Secure}} below.
-->
{{CodeSelect|code=
curl --tlsv1.3 --proto =https --max-time 180 --output derivative.asc https://www.{{project_clearnet}}/keys/derivative.asc
}}
</ref> <ref name=public-key-sources />

{{signing_key_main}}

{{IconSet|h1|3}} Store the key as <code>derivative.asc</code>.

{{IconSet|h1|4}} Check fingerprints/owners without importing anything.

{{CodeSelect|code=
gpg --keyid-format long --import --import-options show-only --with-fingerprint derivative.asc
}}

{{IconSet|h1|5}} Verify the output.

The most important check is confirming the key fingerprint <u>exactly</u> matches the output below. <ref>
Minor changes in the output such as new uids (email addresses) or newer expiration dates are inconsequential.
</ref> (If you have an existing copy of the signing key, see the footnote: <ref>
If you have an existing (potentially expired) copy of the signing key file, and wish to verify that a newer copy is valid, you may use the command <code>gpg --keyid-format long --import --import-options show-only --with-fingerprint /path/to/old/derivative.asc</code> to display the older key's fingerprint. If the fingerprint of the older copy matches the fingerprint of the newer copy, the newer copy is valid.
</ref>)

<pre>
      Key fingerprint = 916B 8D99 C38E AF5E 8ADC  7A2A 8D66 066A 2EEA CCDA
</pre>

In case there is a message <code>gpg: key 8D66066A2EEACCDA: 104 signatures not checked due to missing keys</code> is related to the [[OpenPGP#The_OpenPGP_Web_of_Trust|The OpenPGP Web of Trust]]. [[Advanced Users|Advanced users]] can learn more about this [[#OpenPGP Web of Trust|below]].

{{mbox
| image   = [[File:Ambox_warning_pn.svg.png|warning|40px]]
| text    =
'''Warning:'''

Do not continue if the fingerprint does not match! This risks using infected or erroneous files! The whole point of verification is to confirm file integrity.
}}

{{IconSet|h1|6}} {{signing_key_main_increase_trust}}

{{IconSet|h1|7}} Import the key.

{{CodeSelect|code=
gpg --import derivative.asc
}}

The output should include the key was imported.

<pre>
gpg: key 8D66066A2EEACCDA: public key "Patrick Schleizer <adrelanos@kicksecure.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: marginals needed: 3  completes needed: 1  trust model: pgp
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: next trustdb check due at 2026-01-23
</pre>

''If the {{project_name_short}} signing key was already imported in the past'', the output should include the key is unchanged.

<pre>
gpg: Total number processed: 1
gpg:              unchanged: 1
</pre>

{{IconSet|h1|8}} Web of trust.

[[Advanced Users|Advanced users]] can check [[#Web of Trust|Web of Trust]] further below for better security.
}} <!-- close tab: Windows, Linux, Mac -->
{{Tab
|title= == Kicksecure or Whonix ==
|image=[[File:{{project_name_short}}-logo-icon.svg|25px]]
|content=
{{IconSet|h1|2}} {{signing_key_main_increase_trust}}

{{IconSet|h1|3}} Import the key.

Since the key is already available in Kicksecure or Whonix, importing the key is simpler than for other operating systems.

{{CodeSelect|code=
gpg --import /usr/share/keyrings/derivative.asc
}}

In case there is a message <code>gpg: key 8D66066A2EEACCDA: 104 signatures not checked due to missing keys</code> is related to the [[OpenPGP#The_OpenPGP_Web_of_Trust|The OpenPGP Web of Trust]]. [[Advanced Users|Advanced users]] can learn more about this [[#OpenPGP Web of Trust|below]].

{{IconSet|h1|4}} Skip a few steps.

Steps {{IconSet|h1|2}} to {{IconSet|h1|8}} (which would be required for Windows, macOS and other Linux) can be skipped here. Proceed to step {{IconSet|h1|9}} below.
}} <!-- close tab: Kicksecure or Whonix -->
{{Tab
|title= == Debian ==
|image=[[File:Debian.png|25px]]
|content=
{{IconSet|h1|2}} Install <code>extrepo</code>. <ref>
The extrepo-offline-data Debian package unfortunately is too old and lacks the most recent (extended) version of the signing key.

* https://forums.whonix.org/t/extrepo-safely-adding-repos/8539
* https://forums.whonix.org/t/expkeysig-error-gpg-key-whonix/22721
</ref>

Because it can fetch the signing key.

{{Install Package|package=
extrepo
}}

{{IconSet|h1|3}} {{signing_key_main_increase_trust}}

{{IconSet|h1|4}} Enable the {{project_name_short}} repository.

The purpose of this is to (temporarily) enable the {{project_name_short}} APT repository by utilizing Debian's extrepo to acquire the signing key. Once the repository is no longer needed, it can be disabled (removed), which is documented below. (Related: [[Packages for Debian Hosts]].)

{{CodeSelect|code=
sudo extrepo enable {{project_name_short_lowercase}}
}}

This will create two files. The repository file <code>/etc/apt/sources.list.d/extrepo_{{project_name_short_lowercase}}.sources</code> and the signing key <code>/var/lib/extrepo/keys/{{project_name_short_lowercase}}.asc</code>.

{{IconSet|h1|5}} Import the public key.

{{CodeSelect|code=
gpg --import /var/lib/extrepo/keys/{{project_name_short_lowercase}}.asc
}}

{{IconSet|h1|6}} Disable the {{project_name_short}} APT repository.

<u>Optional.</u> The {{project_name_short}} APT repository was only temporarily enabled to utilize Debian's extrepo to acquire the signing key. The repository is no longer needed. It can be disabled (removed).

{{CodeSelect|code=
sudo extrepo disable {{project_name_short_lowercase}}
}}

{{IconSet|h1|7}} Skip a few steps.

Proceed to step {{IconSet|h1|9}} below.
}} <!-- close tab: Debian and Derivatives -->
}} <!-- close tab controller: operating system selection -->
{{IconSet|h1|9}}  Complete the {{project_name_short}} verification steps.

If verifying {{project_name_short}} images, navigate to the relevant verification page below to finish the process:

* [[File:Tux.png|15px|link=]] [[Verify the_virtual_machine_images_using_the_command line|In Linux]]
* [[File:Logo-windows-500x500.png|15px|link=]] [[Verify_the_images_using_Windows|In Windows]]
* [[File:logo-apple-500x500.png|15px]] [[Verify_the_images_using_macOS|In macOS]]
}}

= OpenPGP Key Features =
* sign/verify {{project_name_short}} images: yes
* sending encrypted e-mails to {{project_name_short}} developer Patrick: yes

= Advanced Users =
{{Anchor|Web of Trust}}
== OpenPGP Web of Trust ==
<u>Optional.</u>

{{AdvancedUsersOnly}}

If you have a good understanding of [[Verifying Software Signatures]], users can check the signing key for additional security.

Wiki page [[OpenPGP#The_OpenPGP_Web_of_Trust|The OpenPGP Web of Trust]] and chapter [[OpenPGP#Bootstrapping_OpenPGP_Keys_from_the_Internet|Bootstrapping OpenPGP Keys from the Internet]] may be helpful.

Third-party signatures attached to the key file or acquired from OpenPGP keyservers are deprecated. For reasons and old documentation, see footnote. <ref>
{{box|text=
Deprecated. Kept for historical reasons.

A few people have signed [[Patrick Schleizer]]'s (adrelanos') OpenPGP key.

Jan Dittberner ({{Code2|Debian Developer}})

* https://jan.dittberner.info/
* https://qa.debian.org/developer.php?login=Jan+Dittberner signed Patrick's key. So did intrigeri (Tails developer, {{Code2|Debian Developer}}); Peter Palfrader ({{Code2|Debian Developer}}); Richard King; and Michael Carbone (accessnow.org).

<u>Notes:</u>

* Key signatures are old (around year 2014).
* This wiki chapter does not account for
** key migration by signers,
** lack of a key transition message, or
** the lack of a key signer signing their new key with their old key.
** signature algorithm SHA1 (<code>gpg</code> <code>--allow-weak-key-signatures</code>)

Users relying on Debian or one of the many Debian derivatives (like Ubuntu) already trust apt, the APT repository of the relevant distribution. This means the Debian keyring can be installed as a trusted source for obtaining Jan's, intrigeri's or Peter's key, to check their signature on Patrick's key.
{{Box|text=
{{IconSet|h1|1}} [[Update]] the package lists.

{{CodeSelect|code=
sudo apt update
}}

{{IconSet|h1|2}} Install the Debian keyring.

{{CodeSelect|code=
sudo apt install debian-keyring
}}

{{IconSet|h1|3}} Extract a signer's key from the Debian keyring and import it into your own keyring.

Here is an example using Jan's key.

{{CodeSelect|code=
gpg --no-default-keyring --keyring /usr/share/keyrings/debian-keyring.gpg --armor --export B2FF1D95CE8F7A22DF4CF09BA73E0055558FB8DD {{!}} gpg --import
}}

{{IconSet|h1|4}} <u>Optional.</u> Try to establish a better trust path to the signer by checking signatures on the signer's key.

Check signatures on Patrick's key.

{{CodeSelect|code=
gpg --check-sigs 916B8D99C38EAF5E8ADC7A2A8D66066A2EEACCDA
}}

The output of the above command should show signatures on Patrick's key, which should include the signer's signature.
}}
}}
</ref>

Nowadays a trust path to the key fingerprint can be established through Debian because Debian package [https://packages.debian.org/{{stable_project_version_based_on_Debian_codename}}/extrepo-offline-data extrepo-offline-data] contains file {{CodeSelect|inline=true|code=/usr/share/extrepo/offline-data/debian/{{stable_project_version_based_on_Debian_codename}}/{{project_name_short_lowercase}}.asc}}. <ref name=public-key-sources>
* extrepo
** https://forums.whonix.org/t/extrepo-safely-adding-repos/8539
** https://salsa.debian.org/extrepo-team/extrepo-data/-/blob/master/repos/debian/kicksecure.yaml
** https://salsa.debian.org/extrepo-team/extrepo-data/-/blob/master/repos/debian/whonix.yaml
* Kicksecure:
** https://www.kicksecure.com/keys/derivative.asc
** https://github.com/derivative-maker/derivative-maker/blob/master/keys/derivative.asc
** https://github.com/Kicksecure/repository-dist/blob/master/usr/share/keyrings/derivative.asc
** https://github.com/Kicksecure/usability-misc/blob/master/usr/bin/repo-add-dist
** https://github.com/Kicksecure/qubes-template-kicksecure/blob/master/keys/kicksecure-developer-patrick.asc
** <code>/usr/share/keyrings/derivative.asc</code>
* Whonix:
** https://www.whonix.org/keys/derivative.asc
** https://github.com/Whonix/qubes-template-whonix/blob/master/keys/whonix-developer-patrick.asc
* Qubes:
** https://github.com/adrelanos/qubes-builderv2/blob/main/qubesbuilder/plugins/fetch/keys/916B8D99C38EAF5E8ADC7A2A8D66066A2EEACCDA.asc
*** https://github.com/QubesOS/qubes-builderv2/pull/229
** https://github.com/QubesOS/qubes-builderv2-github/blob/main/keys/916B8D99C38EAF5E8ADC7A2A8D66066A2EEACCDA.asc
*** https://github.com/QubesOS/qubes-builderv2-github/pull/29
* Misc:
** https://keys.openpgp.org/vks/v1/by-fingerprint/916B8D99C38EAF5E8ADC7A2A8D66066A2EEACCDA
** https://keybase.io/adrelanos
** https://api.github.com/users/adrelanos/gpg_keys
</ref>

== Download the signify Key ==
[[File:Signify_Logo.svg|thumb|100px|signify]]

{{mbox
| type    = notice
| image   = [[File:Ambox_notice.png|40px|alt=Info]]
| text    = [[Advanced Users|Advanced users]] only!
}}

<ref>
<pre>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

untrusted comment: Patrick Schleizer adrelanos@whonix.org signify public key
RWQ6KRormNEETq+M8IysxRe/HAWlqZRlO8u7ACIiv5poAW0ztsirOjCQ
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEEbpebKKbzfEO+MK+hy41Qu3e7PEgFAmInQmhfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDZF
OTc5QjI4QTZGMzdDNDNCRTMwQUZBMUNCOEQ1MEJCNzdCQjNDNDgACgkQy41Qu3e7
PEhSyg/+J2R20mA5xVDT0FlZrtHXnNkZzg48FbSteak6utpmd9HGZlTxlEA3ou8z
MlDGDHAYgpfe74suqQl2dEql6Mio4YuUou8GW2aEJ+AVa5jRlHMj4H9alTGmUtok
UdaCVVQQO/FCE3y1N00TmuxyDghP9dm1cT8mho0P0RbVoqQyMTDIzLiXCa5aPwu/
nyBGwxdVPuGNZ0WYJfKXLRdb/3q2xprYDQOTehLDHnUVins2kKnsbwVTBY4u4575
KQfOwZD176oQZlZOuw6qxhOd0RWF33TMnQXKPjmaTpTjtsbKOascNBqnjDZbDNhl
MSmRKvPZ4bi3IbpSsZdRiwXEOEnyeRhqlwhGX8UecU5e31iMRx8vJDA3u2oSQnrZ
l8vnFvnnkGe3/COMAAlIEH+bFofFui3QMWYzX5A2g4jHzfgdrYJcNEZmaeptIRJj
qs2eteI7FFt/hQaEZimN6TES0o91+JDLQPHDkEbbE8V9qOxUE6+pqLnRmr/uAMbc
3WA73dphJQfBHQOT2k+ByrrZ/h18x5YrMhvr8HB0f8ejU9YiWG/YnbPvvPNuSdQb
1xSaWmWrXpFgDMOJuG0H7uQi+IcZgQj+JsPaMXTZ6ehHyAr50c61TBoG/UzOXTJg
YlD+NW0yh7b2XBXsL4Xj0X1lrHBxFGHiaM7zC//pIPKTG7kfyJ4=
=n5bK
-----END PGP SIGNATURE-----
</pre>
</ref>

{{signing_key_main_signify}}

= Further Reading =
* [https://en.wikipedia.org/wiki/GNU_Privacy_Guard GnuPG wikipedia] - Freedom Software OpenPGP software.
* [https://www.apache.org/dev/openpgp.html Apache: How To OpenPGP].
* [https://www.debian.org/events/keysigning Debian: Keysigning] - a tutorial on signing keys of other people.
* [https://www.rubin.ch/pgp/weboftrust.en.html rubin.ch: An explanation of the PGP web of trust].

{{Template:GnuPG-Troubleshooting}}

= See Also =
* [[Verify the images|Verify {{project_name_short}} Images]]
* [[Verifying Software Signatures]]
* [[Trust|Placing Trust in {{project_name_short}}]]
* [[OpenPGP|OpenPGP key distribution strategies]]

= License =
{{License_Amnesia|{{FULLPAGENAME}}}}

= Footnotes =
{{reflist|close=1}}
{{Footer}}
[[Category:Documentation]]
[[Category:MultiWiki]]