[[!meta title="Verify the ISO image using the command line"]] [[!inline pages="doc/get/signing_key_transition.inline" raw="yes"]]
You need to have GnuPG installed. GnuPG is the common OpenPGP implementation for Linux: it is installed by default under Debian, Ubuntu, Tails and many other distributions.
First, download Tails signing key:
[[!inline pages="lib/download_tails_signing_key" raw="yes"]]Open a terminal and import Tails signing key with the following commands:
cd [the directory in which you downloaded the key] gpg --keyid-format long --import tails-signing.key
The output should tell you that the key was imported:
gpg: key DBB802B258ACD84F: public key "Tails developers (offline long-term identity key) <tails@boum.org>" imported gpg: Total number processed: 1 gpg: imported: 1 (RSA: 1)
If you had already imported Tails signing key in the past, the output should tell you that the key was not changed:
gpg: key DBB802B258ACD84F: "Tails developers (offline long-term identity key) <tails@boum.org>" not changed gpg: Total number processed: 1 gpg: unchanged: 1
If you are shown the following message at the end of the output:
gpg: no ultimately trusted keys found
Analyse the other messages as usual: this extra message doesn't relate to the Tails signing key that you downloaded and usually means that you didn't create an OpenPGP key for yourself yet, which of no importance to verify the ISO image.
Now, download the cryptographic signature corresponding to the ISO image you want to verify and save it in the same folder as the ISO image:
[[!inline pages="lib/download_stable_i386_iso_sig" raw="yes"]]Then, start the cryptographic verification, it can take several minutes:
cd [the ISO image directory]
[[!inline pages="inc/stable_i386_gpg_verify" raw="yes"]]
If the ISO image is correct the output will tell you that the signature is good:
pg: Signature made Sun 08 Feb 2015 08:17:03 PM UTC gpg: using RSA key 98FEC6BC752A3DB6 gpg: Good signature from "Tails developers (offline long-term identity key) <tails@boum.org>" [unknown] Primary key fingerprint: A490 D0F4 D311 A415 3E2B B7CA DBB8 02B2 58AC D84F Subkey fingerprint: BA2C 222F 44AC 00ED 9899 3893 98FE C6BC 752A 3DB6
or:
pg: Signature made Sun 08 Feb 2015 08:17:03 PM UTC gpg: using RSA key 3C83DCB52F699C56 gpg: Good signature from "Tails developers (offline long-term identity key) <tails@boum.org>" [unknown] Primary key fingerprint: A490 D0F4 D311 A415 3E2B B7CA DBB8 02B2 58AC D84F Subkey fingerprint: A509 1F72 C746 BA6B 163D 1C18 3C83 DCB5 2F69 9C56
If you see the following warning:
gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: A490 D0F4 D311 A415 3E2B B7CA DBB8 02B2 58AC D84F
Then the ISO image is still correct, and valid according to the Tails signing key that you downloaded. This warning is related to the trust that you put in the Tails signing key. See, [[Trusting Tails signing key|doc/get/trusting_tails_signing_key]]. To remove this warning you would have to personally [[!wikipedia Keysigning desc="sign"]] the Tails signing key with your own key.
If the ISO image is not correct the output will tell you that the signature is bad:
gpg: Signature made Sat 30 Apr 2015 10:53:23 AM CEST gpg: using RSA key DBB802B258ACD84F gpg: BAD signature from "Tails developers (offline long-term identity key) <tails@boum.org>"