Dev1 Galaxy Forum / [SOLVED] Verify the images missing argument on web page

Re: [SOLVED] Verify the images missing argument on web page

dummy@example.com (Xenguy) — Fri, 01 May 2026 02:04:51 +0000

Not at all; thank you again for the bug report.

Re: [SOLVED] Verify the images missing argument on web page

dummy@example.com (laurie_dev1) — Fri, 01 May 2026 01:42:29 +0000

My apologies.

Originally when I saved the file i used "saved as" when downloading the SHA256SUM.txt as sha256 to shorten the name, not thinking it needed the exact file name to pick it up.

Re: [SOLVED] Verify the images missing argument on web page

dummy@example.com (Xenguy) — Fri, 01 May 2026 01:30:56 +0000

Hi,

The instructions on https://www.devuan.org/os/documentation … evuan.html say to download the 'SHA256SUMS.txt' file, in the previous section of the instructions.

You appear to have skipped this step, and that's why the error was received when trying to verify the ISO image; the SHA256SUMS.txt file was not present, as it needed to be, when you tried.

Section 'Check the integrity of images' instructs the user to "Download the SHA256SUMS.txt file". The following section 'Verify the images' depends on the user having followed the instructions in the former section.

Thanks in any case for reporting the issue, we value our testers and bug reporters.

[SOLVED] Verify the images missing argument on web page

dummy@example.com (laurie_dev1) — Thu, 30 Apr 2026 06:54:29 +0000

I was setting up a new PC today, installation went very well.

I spotted a missing argument that may have been overlooked on the devuan.org excalibur install page in regards to verifying the images.

Verify the images
Installation images distributed by Devuan are signed so that they can be verified as coming from Devuan. Verifying images checks that they have not been altered in transit.
Get the Devuan developers signing keys and import them to the GPG keyring.
user@hostname:~$ gpg --import devuan-devs.gpg
Download and use the signed SHA256SUMS.txt.asc file, from the release archive, to verify the image.
user@hostname:~$ gpg --verify SHA256SUMS.txt.asc
A report of a good signature indicates everything is fine.

user@hostname:~$ gpg --verify SHA256SUMS.txt.asc 
gpg: no signed data
gpg: can't hash datafile: No data

it needs the SHA256SUMS.txt data file like so...

user@hostname:~$ gpg --verify SHA256SUMS.txt.asc SHA256SUMS.txt 
gpg: Signature made Sun 26 Apr 2026 01:16:25 AEST
gpg:                using RSA key 185E56E98DA03B6CEADAC81983161D4768BE620B
gpg:                issuer "dev1@tempforever.com"
gpg: Good signature from "tempforever " [unknown]
gpg: WARNING: The key's User ID is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 185E 56E9 8DA0 3B6C EADA  C819 8316 1D47 68BE 620B