don't know if this is of any help to anyone except maybe past me, but i had a hard time finding the correct Public Key to verify the current Krita AppImage: So what finally worked was gpg --import this Public Key here https://files.kde.org/krita/dmitry_kazakov.gpg and gpg --verify krita-5.2.9-x86_64.AppImage.sig then gpg says Good signature (fingerprint: E9FB 29E7 4ADE ACC5 E303 5B8A B69E B4CF 7468 332F). Anyway (>' v ')> here is a drawing i made using my laptops wonky touchpad.
KOOL
17 Comments
gnuplusmatt@reddthat.com · 15 pts · 1y
if you're worried about the integrity of the sources you're installing from why are you using app images? Use a repo, or flathub
SatyrSack@feddit.org · 11 pts · 1y
*KOOL
nonanomalus@lemmy.sdf.org · 9 pts · 1y
korrected
SatyrSack@feddit.org · 8 pts · 1y
Kongratulations
racketlauncher831@lemmy.ml · 2 pts · 1y
Ceep up the good work oops.
steeznson@lemmy.world · 1 pts · 1y
:grimace:
lumony@lemmings.world · 1 pts · 1y
mactan@lemmy.ml · 8 pts · 1y
compile it yourself I guess
doomsdayrs@lemmy.ml · 3 pts · 1y
Why would you sign it?
nonanomalus@lemmy.sdf.org · 3 pts · 1y
Ah i meant i downloaded the signature from download.kde.org/stable/krita/5.2.9/, just wanted to make sure that the Krita AppImage i had was legitimate
AnUnusualRelic@lemmy.world · 0 pts · 1y
Look at the properties of the file in dolphin. It will show you various file
signatureschecksums.nonanomalus@lemmy.sdf.org · 2 pts · 1y
sorry, i think my post might be a little misleading everything is fine with the AppImage and the Detached signature (downloaded from krita.org) always has been as far as i know, i only verified the AppImage for 'fun'. The only hiccup i had was that the webpage was unclear on where to find the PGP Public key, that you use to verify the signature. of course doing this is not necessary since i downloaded the AppImage from the official webpage over a secure connection.
BlindFrog@lemmy.world · 2 pts · 1y
Where did you download krita from?
racketlauncher831@lemmy.ml · 2 pts · 1y
The official website?
merthyr1831@lemmy.ml · 1 pts · 1y
Do they not provide an md5sum? I've never seen anyone check an app's integrity issuing public keys
nonanomalus@lemmy.sdf.org · 1 pts · 1y
i couldn't find the md5sum s for the current version, i saw they do provide some for older versions https://download.kde.org/Attic/krita/5.2.0/, but they do have GPG Signatures .sig files at https://download.kde.org/stable/krita/5.2.9/ for the current version
Luck@lemmy.one · 2 pts · 1y
It's under details.
nonanomalus@lemmy.sdf.org · 1 pts · 1y
Awesome thanks, your right, can't believe i missed that, i guess details do matter