# Verifying the Yoslion Download package for Linux

This page covers **Yoslion Download 1.0.2 for Linux**
(`yoslion-download_1.0.2_amd64.deb`), signed with the OpenPGP key whose full
fingerprint is `6EAEC1D596F6C0F7B546EE854907B9F29B713D89`. Every command below is one
you run yourself, on files you already have.

## Read this first

**Installing a `.deb` does not check any of this.** `sudo dpkg -i` and
`sudo apt install ./file.deb` install the package without verifying who made it. That is
true of every `.deb` from anywhere. The check below is something you choose to do, not
something your system does for you.

**This key is not a certificate your system recognises.** Nothing in a stock Debian or
Ubuntu installation trusts it, and nothing will warn you if you skip this. What the
signature proves is narrow and worth having: the file you are holding was produced by
Palacios Software Group LLC and has not been altered since.

## 1. Get the package, the signature and the key

```bash
cd ~/Downloads
BASE=https://updates.yoslion.com
curl -fLO "$BASE/release/linux/x86_64/1.0.2/yoslion-download_1.0.2_amd64.deb"
curl -fLO "$BASE/release/linux/x86_64/1.0.2/yoslion-download_1.0.2_amd64.deb.asc"
curl -fLO "$BASE/keys/yoslion-linux-signing-6EAEC1D596F6C0F7B546EE854907B9F29B713D89.asc"
```

## 2. Check the fingerprint before trusting the key

**This step is the one that carries the weight, and skipping it makes the rest
ceremonial.** All three files above came from the same server. Anyone who could replace
the package there could replace the signature and the key along with it, and every command
below would then report a perfectly good signature over a file you did not want. A
signature proves that the package and the key go together — it cannot prove the key is
ours.

So the fingerprint has to be confirmed through something that is not that server: the
value published on the Yoslion website, a copy you were given directly, or one you noted
the first time and kept.

```bash
gpg --show-keys --with-fingerprint yoslion-linux-signing-6EAEC1D596F6C0F7B546EE854907B9F29B713D89.asc
```

It must be exactly:

```
6EAE C1D5 96F6 C0F7 B546  EE85 4907 B9F2 9B71 3D89
```

**Compare the whole of it.** The last eight characters are a "short id", and short ids can
be manufactured to collide. A key whose short id matches and whose fingerprint does not is
not this key. The file name carries the full fingerprint for the same reason: a future key
will never reuse this address.

## 3. Verify the package

```bash
gpg --dearmor < yoslion-linux-signing-6EAEC1D596F6C0F7B546EE854907B9F29B713D89.asc > yoslion.gpg
gpgv --keyring ./yoslion.gpg yoslion-download_1.0.2_amd64.deb.asc yoslion-download_1.0.2_amd64.deb
```

A good result names the same fingerprint you checked above:

```
gpgv: Signature made ...
gpgv:                using EDDSA key 6EAEC1D596F6C0F7B546EE854907B9F29B713D89
gpgv: Good signature from "Palacios Software Group LLC (Yoslion Download Linux Package Signing) <contact@palaciossoftwaregroup.com>"
```

**Keep the `./`.** `gpgv` resolves a bare `--keyring yoslion.gpg` inside your GnuPG home
directory, not the folder you are standing in — so dropping it makes `gpgv` run with no
keyring at all and answer *"Can't check signature: No public key"*. That is not a verdict
about the package, and reading it as one is how a verification comes to prove nothing.
Measured while writing these instructions.

What the three outcomes mean:

| Output | Exit | Meaning |
| --- | --- | --- |
| `Good signature` | 0 | These bytes were signed by that key. |
| `BAD signature` | 1 | The package or the signature has been altered. Do not install. |
| `Can't check signature: No public key` | 2 | The keyring you pointed at does not hold this key. Fix the command before concluding anything. |

**Nothing here touches APT.** No file is written to `/etc/apt/trusted.gpg.d` or
`/usr/share/keyrings`, and no step asks for `sudo`. The key is used for one check, from a
file in the directory you are in, and your system is left exactly as it was.

## 4. Then install

```bash
sudo apt install ./yoslion-download_1.0.2_amd64.deb
```

## The checksum, if you want it

The signature already covers every byte, so this adds no security. It is useful for
confirming that a copy you received some other way is the published one:

```bash
sha256sum yoslion-download_1.0.2_amd64.deb
```

```
acb0811e5889e3cc8aff90b8fcd4d56fd44cd914db341b66d4a7e4aed392cc4c
```