I have downloaded the Fedora-33 KDE spin and am attempting to verify it. Following the instructions (appended below for convenience) I have: * Imported the keys using curl (where do they go?) and * Verified the CHECKSUM file using gpg
The verification fails with this message: $ gpg --verify-files *-CHECKSUM gpg: Signature made Fri 23 Oct 2020 08:09:07 AM PDT gpg: using RSA key 963A2BEB02009608FE67EA4249FD77499570FF31 gpg: Good signature from "Fedora (33) fedora-33-primary@fedoraproject.org" [unknown] gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 963A 2BEB 0200 9608 FE67 EA42 49FD 7749 9570 FF31 This doesn't look good. How can I verify the CHECKSUM file?
Verification instructions from https://spins.fedoraproject.org/en/verify%C2%A0follow: Next, import Fedora's GPG key(s): $ curl https://getfedora.org/static/fedora.gpg | gpg --import You can verify the details of the GPG key(s) here. Now, verify that the CHECKSUM file is valid: $ gpg --verify-files *-CHECKSUM The CHECKSUM file should have a good signature from one of the following keys: - 12C944D0 - Fedora 32 - 3C3359C4 - Fedora 31 - CFC659B9 - Fedora 30 - DBBDCF7C - IOT 2019 Finally, now that the CHECKSUM file has been verified, check that the image's checksum matches: $ sha256sum -c *-CHECKSUM If the output states that the file is valid, then it's ready to use!