Can't check signature: No public key (GPG)

Support and Advice General Questions
1

Hi,

I wanted to migrate from 4.X to 5.X, but when itry to verify GPG key i have this message :

“Signature made Wed. 27 Apr 2022 11:03:05 CEST
gpg: avec la clef RSA 064182440C674D9F8D0F6F8B4DA79EDA231C852B
gpg: Can’t check signature: No public key”

Here is what i’ve done so foar :

  1. Downloaded krita.appimage
  2. Downloaded krita.appimage.sig
  3. Launch Comand Line
  4. gpg --verify ‘path/krita.sig’ ‘path/krita.appimage’

I’m i doing somthing wrong ?

2

According to the 5.0.6 release notes here:
Krita 5.0.6 Released | Krita

… the public key is here:
https://files.kde.org/krita/4DA79EDA231C852B

So you’d need to import the Public Key into the GPG utility.

1 Like
3

Ok thank you,

But then does that mean that i was doing it wrong ? Because i wasn’t using the public key at all in my procedure let’s say

Could you guide me ?

4

The public key needs to be on the keyring that GPG uses.
You do that with gpg --import pubkeyfilename

After that, when you do the gpg --verify signaturefile appfile command, the signature file goes through some secure check process to make sure it was generated by the owner of the public key.

Try it and see what happens.

5

Ok thanks a lot !

So it worked, but it says :
" Good signature […] Careful ! This key is not certified with a trusted signature. Nothing indicates that the singature belongs to his owner" (i’m translating from french)

Did i do something wrong ?

I followed your exact steps…

6

You should read in the Wikipedia of your native language the principle of PGP and the “Web of Trust”, it seems to me that you have not internalized it :wink:

Michelist

Add: Hello @AhabGreybeard :slight_smile:

1 Like
7

I understand the high level principles of Public/Private key systems but the detailed operation and verifying business is a magical mystery to me.

It looks like the appimage, it’s signature file and the Public Key are all compatible with each other.
However, there seems to be an additional thing where the Public key is verfied (for ownership) by another authority. That may cost money and that would be a good reason why the developers haven’t done that.

Given that the Public key was downloded from the the official KDE site, I’d tend to be confident that it is a genuine public key.

Hello @Michelist :slight_smile:

2 Likes
8

@Michelist
I’m pretty new to this as you could see, but i’m trying to go above the learning curve to… Actually learn…

I’ll try to see the page you recommended me :slight_smile:

@AhabGreybeard Ok thanks a lot for your support it’s really helpful to me :slight_smile:

Have a good day both of you and happy drawings ! :slight_smile:

3 Likes
9

That is the right attitude! I’m glad you want to try to work out the answer yourself, you have my respect!
:+1:

Michelist

2 Likes
10

I just have a last question regarding the .appimage :

Will i have the ability to update the app ? Or will i have to re-do thsi procedure manually periodically to see if there is a new option available ?

11

When the next formal release is made, you’ll have to download the appimage for it.

There is something happening with an appimage updating mechanism called ‘zsync’ but I don’t know any details about that.
The nighly builds have that as a file for download:
Krita_Nightly_Appimage_Build [Jenkins]

It’s the Krita-Next-x86_64.appimage.zsync file but I’ve no idea how it works or if it works.

1 Like
12

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.