Score:0

ubuntu 20.04.1 LTS: No verification for DSA (only for RSA)

fr flag

I've just downloaded the iso file from https://releases.ubuntu.com/jammy/ and also SHA256SUMS and SHA256SUMS.gpg. When performing, as described in https://ubuntu.com/tutorials/how-to-verify-ubuntu#1-overview ,

gpg --keyid-format long --verify SHA256SUMS.gpg SHA256SUMS

I get

gpg: Signature made Thu Aug 11 13:07:33 2022 CEST
gpg:                using RSA key 843938DF228D22F7B3742BC0D94AA3F0EFE21092
gpg: Good signature from "Ubuntu CD Image Automatic Signing Key (2012)    
<cdimage@ubuntu.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 8439 38DF 228D 22F7 B374  2BC0 D94A A3F0 EFE2 1092

The second good signature is missing. What does this mean?

Information: The command

gpg --list-keys --with-fingerprint 0xFBB75451 0xEFE21092

gives

pub   rsa4096 2012-05-11 [SC]
  8439 38DF 228D 22F7 B374  2BC0 D94A A3F0 EFE2 1092
uid           [ unknown] Ubuntu CD Image Automatic Signing Key (2012)   
<cdimage@ubuntu.com>

pub   dsa1024 2004-12-30 [SC]
  C598 6B4F 1257 FFA8 6632  CBA7 4618 1433 FBB7 5451
uid           [ unknown] Ubuntu CD Image Automatic Signing Key <cdimage@ubuntu.com>
Score:0
fr flag

When performing

echo "c396e956a9f52c418397867d1ea5c0cf1a99a49dcf648b086d2fb762330cc88d *ubuntu-22.04.1-desktop-amd64.iso" | shasum -a 256 --check

I get (after ca. 1 minute)

ubuntu-22.04.1-desktop-amd64.iso: OK

so everything may be correct. NB. In my opinion the tutorial https://ubuntu.com/tutorials/how-to-verify-ubuntu#1-overview is a bit misleading.

I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.