Download and verify a source using multiple procedures
Download sources
Get the source link from the original app repository (i.e. Yunohost) and download it in a temporary folder
BASH
mkdir -p ~/sources/unverified
wget -P ~/sources/unverified/ https://repo.yunohost.org/images/yunohost-bookworm-12.0.16-rpi-stable.img.gz
Get public key, cheksum and signature as well
BASH
wget -P ~/sources/ https://forge.yunohost.org/keys/yunohost_bookworm.asc
wget -P ~/sources/ https://repo.yunohost.org/images/yunohost-bookworm-12.0.16-rpi-stable.img.gz.sha256sum
wget -P ~/sources/ https://repo.yunohost.org/images/yunohost-bookworm-12.0.16-rpi-stable.img.gz.sig
Change active directory
BASH
cd ~/sources/unverified
Verify the download
Import the public key
Import the public key file
BASH
gpg --import ~/sources/yunohost_bookworm.asc
gpg: key 5D09F2273DAC3BD5: public key "Yunohost .deb build system (bookworm)" imported gpg: Total number processed: 1 gpg: imported: 1
Verify with SHA256 Checksum
BASH
sha256sum -c ~/sources/yunohost-bookworm-12.0.16-rpi-stable.img.gz.sha256sum
yunohost-bookworm-12.0.16-rpi-stable.img.gz: OK
Verify with GPG Signature
BASH
gpg --verify ~/sources/yunohost-bookworm-12.0.16-rpi-stable.img.gz.sig yunohost-bookworm-12.0.16-rpi-stable.img.gz
gpg: Signature made Mon 05 May 2025 04:18:23 PM CEST gpg: using RSA key E05E79061221D737567D38875D09F2273DAC3BD5 gpg: Good signature from "Yunohost .deb build system (bookworm)" [unknown]
Optional: Mark the file as verified
BASH
mkdir -p ~/sources/verified
mv ~/sources/unverified/yunohost-bookworm-12.0.16-rpi-stable.img.gz ~/sources/verified/