[SOLVED] MX-17.1: GPG-verification of ISO outputs "BAD signature"

[MX-16_fan]

@Adrian:

... I choose to display there the latest snapshot because we try to encourage people to get the latest and greatest (with of the bugs squashed hopefully). (...)

I understand.

How would I check a snapshot against your key?


Greetings, Joe

[Adrian]

https://mxlinux.org/wiki/system/signed-iso-files

[MX-16_fan]

@Adrian:

https://mxlinux.org/wiki/system/signed-iso-files

I guess one would need an "MX-17.1_June_x64.iso.sig" for that. Correct?

Can't see any on https://sourceforge.net/projects/mx-lin ... l/MX-17.1/.


Greetings, Joe

[timkb4cq]

That's because it is not a Final, it is a Snapshot so it is here:
https://sourceforge.net/projects/mx-lin ... Snapshots/

[fehlix]

Can't see any on https://sourceforge.net/projects/mx-lin ... l/MX-17.1/.

Look again:
https://sourceforge.net/projects/mx-lin ... 64.iso.sig
https://sourceforge.net/projects/mx-lin ... 64.iso.md5
https://sourceforge.net/projects/mx-lin ... ne_x64.iso

[MX-16_fan]

@fehlix:

(...)
Look again:
https://sourceforge.net/projects/mx-lin ... 64.iso.sig
https://sourceforge.net/projects/mx-lin ... 64.iso.md5
https://sourceforge.net/projects/mx-lin ... ne_x64.iso

Thanks, now I got it.

Of course the signature for the "June" ISO is in "Home / Snapshots", not in "Home / Final".

This resolves the issue. I'll mark this "SOLVED".


@Adrian:

While the issue itself is fixed, I guess this question might come up again, as the user journey remains to be somewhat confusing.

I fully understand your argument (preferably advertising the snapshots), but maybe there would be a way of making the download journey less prone to misunderstandings. I don't have a clear idea about how one could do that, but in case I find a solution, I can post a separate proposal for that if that's of any help.


@all:

Have a great weekend, and thanks a lot to all of you.


Greetings, Joe