Since the introduction of the new Tails signing key, which I think was towards the end of 2015, I have had variable success in verifying my download of the Tails ISO file. For example, to verify the tails-amd64-3.6.iso
file, I enter the command
gpg --keyid-format 0xlong --verify tails-amd64-3.6.iso.sig tails-amd64-3.6.iso
which returns the informative message:
gpg: Signature made Tue 13 Mar 2018 11:41:20 AEDT
gpg: using RSA key 0x3020A7A9C2B72733
gpg: Good signature from "Tails developers <[email protected]>"
gpg: aka "Tails developers (offline long-term identity key) <[email protected]>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: A490 D0F4 D311 A415 3E2B B7CA DBB8 02B2 58AC D84F
Subkey fingerprint: 2FAF 9BA0 D65B B371 F0BC 2D46 3020 A7A9 C2B7 2733
However, when I attempt the same with the tails-amd64-3.6.1.iso
using the supplied signature file tails-amd64-3.6.1.iso.sig
, using the command
gpg --keyid-format 0xlong --verify tails-amd64-3.6.1.iso.sig tails-amd64-3.6.1.iso
I get the following output:
gpg: Signature made Sat 17 Mar 2018 11:08:42 AEDT
gpg: using ? key 0x90B2B4BD7AED235F
gpg: Can't check signature: unknown pubkey algorithm
What is going wrong, and what is it that I should have done, or be doing?
I realize that there is always the remote possibility that I have downloaded a fake Tails iso file. For what it is worth,
sha256sum --binary tails-amd64-3.6.1.iso
gives
826c8fc05a7fb04962c6a45350648fc9273bf98f8b19b2d5a491b440d78ecbf6 *tails-amd64-3.6.1.iso
NEW INFO ADDED 2018-03-23 : I have installed the Tails verification extension in Firefox, which verifies the download. However, I'd still be very interested to know why the gpg
check fails (despite the same approach succeeding with the 3.6 ISO)