fedora-iot

#28 Fedora IoT cannot be verified
Closed: fixed by axels. Opened by axels.

Closed: fixed
Reopen Issue

Hello,
I was trying to download and verify Fedora IoT, specifically Fedora-IoT-32-20200603.0.x86_64.raw.xz, but couldn't find the information necessary to verify it.

The Fedora IoT landing page "Verify" link leads to the general Get Fedora security page, which:
1. makes no mention of Fedora IoT (or any other spin apart from Workstation and Server, for that matter),
2. has no link to any CHECKSUM file for Fedora IoT to be seen.

Links to the CHECKSUM files for Fedora IoT (and other spins) should either be added to https://getfedora.org/security/, or Fedora IoT should have its own security page which hosts the Fedora IoT CHECKSUM files.

Furthermore, the Security page has other problems.
The page states: "start by downloading the proper CHECKSUM file into the same directory as the image you downloaded", but while it tells you how to download the PGP key using curl, and how to verify using gpg, it fails to explain how to actually download the *-CHECKSUM file.

For this third problem, i think the list of steps to follow should be made (even more) explicit:
0. After this introductory text, explicitly start the list of steps with: First, download the CHECKSUM for the image you downloaded
1. Then, import Fedora's GPG key(s):
etc.
2. Now, verify that the CHECKSUM file is valid:
etc.
3. Lastly, check that your download's checksum matches:
etc.

Hope this helps!

Fedora IoT checksums have been added to the https://getfedora.org/security/ page. Thanks for the ticket.

@pbrobinson, @pwhalen can you mark as "Fixed" and close this please?

Nice, thanks @coremodule.

I think there is still an issue with the text on the Security page, as it still mentions 3 steps (and shows 3 commands) when there are really 4:
1. Vownload CHECKSUM file
2. Import GPG key
3. Verify CHECKSUM file integrity
4 Verify iso/raw image integrity

Not of utmost importance, but let's make things as easy as possible for newcomers trying to do the right thing.

It will be fixed this week with both a new F-32 release and F-33 beta going out, it will be closed once that is done

So there's a new F-32 release on https://iot.fedoraproject.org/ with the checksums signed, @axels can you verify it looks good to you?

Hi @pbrobinson, sorry for the slow reply.

Just tested it with the current version, and the process works well. I'll go ahead and close this issue.

Nitpick: the CHECKSUM files are currently called Fedora-IoT-IoT-33-aarch64-20201102.0-CHECKSUM (so, Iot-IoT, which sounds like one IoT too many), but otherwise, all good.

Metadata Update from @axels:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.