I had performed several unsuccessful DuckDuckGo searches on site:devuan.org, looking for “tempforever.com” or its long-format RSA key fingerprint, but not for “tempforever” or its short-format key fingerprint.

I just imported tempforever's public RSA key and successfully verified the installer-iso/SHA256SUMS.txt file downloaded via the magnet link.

Everything is OK.
Many thanks to the whole team for their great work on Devuan 6!

his key didn't get added to the devuan-keyring package until a couple days ago. It's currently in ceres (version 2026.01.13)

I would add to that, it's also in https://files.devuan.org/devuan-devs.gpg from a couple days ago.

And here if you search for tempforever:
https://keyring.devuan.org/

Which will show you that his key has been signed by another devuan dev:
https://keyring.devuan.org/pks/lookup?o … 4768BE620B

He's one of us, for sure. Unfortunately, his key didn't get added to the devuan-keyring package until a couple days ago. It's currently in ceres (version 2026.01.13)

Regarding the desktop-live/ and minimal-live/ directories, everything is OK, because the command

gpg --verify <NAME>.iso.sha256.asc <NAME>.iso.sha256

returns:

gpg: Signature made Sat Jan  3 01:09:42 2026 CET
gpg:                using RSA key 67F5013216271E85C251E480A73823D3094C5620
gpg: Good signature from "fsmithred (aka fsr) <fsmithred@gmail.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 67F5 0132 1627 1E85 C251  E480 A738 23D3 094C 5620

This result is normal and confirms the authenticity of the .sha256 file in relation to Devuan's official public GPG key, which I imported into my keyring from the official file https://files.devuan.org/devuan-devs.gpg, without assigning it a specific trust level.

BUT, in the installer-iso/ directory:

user@devuan:~$ gpg --verify SHA256SUMS.txt.asc SHA256SUMS.txt
gpg: Signature made Thu Dec 25 19:41:10 2025 CET
gpg:                using RSA key 185E56E98DA03B6CEADAC81983161D4768BE620B
gpg:                issuer "dev1@tempforever.com"
gpg: Can't check signature: No public key

→ This RSA fingerprint does not match any key in my GPG keyring, even though I imported the contents of the official file https://files.devuan.org/devuan-devs.gpg!

The gpg --verify result is the same when I download these two files, SHA256SUMS.txt.asc and SHA256SUMS.txt, via HTTP from an official mirror.

I see two possibilities:

• Either the official file https://files.devuan.org/devuan-devs.gpg is incomplete

• Or the files in the installer-iso/ directory have been tampered with by an unauthorized person (outside the Devuan team project)

And I notice that:

• Regarding the address dev1@tempforever.com, DuckDuckGo returns a list of temporary email address providers, and nothing for “tempforever.com.”

• The tempforever.com website cannot be reached via HTTP because its Apache 2.4.65 server running Debian (IP: 167.88.38.250) located in Boston, USA, is not configured (according to https://sitecheck.sucuri.net/).

• A whois query indicates that the tempforever.com domain was created on March 30, 2021. A few months later, on December 26, 2021, a snapshot of the site's home page was saved on the Internet Archive (https://web.archive.org/web/20211226174 … rever.com/), which redirects to an April 15, 2022 archive of splittheirears.com

The GPG key corresponding to this RSA signature and mysterious email address is available on the hkp://keyserver.ubuntu.com/ server. But since it is not mentioned on the official devuan.org website (https://www.devuan.org/os/keyring), I cannot trust it at all.

I work with Devuan 5 every day and I need to have confidence in the entire Devuan infrastructure in order to continue with Devuan 6.
Am I missing something? Or is this a real problem?

Most of us probably won't notice, except a few who use syslinux on usb and even then, depending on your local syslinux configuration.

EDIT: I'm guessing those modules are incompatible with current ldlinux.sys, which gets updated during syslinux installation to the drive.

Where do /isolinux/*.c32 in the ISO originate from and why are they different?

Oh! They come from the stale versions in the live-sdk build tree. That needs to be re-worked so I don't have to remember to update them.

sha256:
392032e530b6c03b1e92431401de734fc7746342ae883df486d4a3a4fe403805
devuan_excalibur_6.1.1_amd64_minimal-live.iso

On investigation I found the md5sums of /isolinux/*.c32 are different from what is in the (system's) /usr/lib/syslinux/modules/bios

Which devuan ISO file are you using?

Trying the new ISO in qemu I can't get it to boot from a syslinux USB in my usual way (using the
*.c32 modules from /isolinux). Although qemu does boot the ISO directly.

Undef symbol FAIL: init_fpu
Failed to load libcom32.c32
Failed to load COM32 file vesamenu.c32

On investigation I found the md5sums of /isolinux/*.c32 are different from what is in the (system's) /usr/lib/syslinux/modules/bios ..

They also differ from my own /usr/lib/syslinux/modules/bios/ in both excalibur and daedalus.

If I replace those modules in my USB's /syslinux with the ones from the system, everything works as expected.

I already have verified the sha256sum of the ISO.

Where do /isolinux/*.c32 in the ISO originate from and why are they different?

That was annoying lol.

This only affects the live isos. The installer isos are unchanged.

New torrent file (same link, different file):
https://files.devuan.org/devuan_excalibur.torrent

New magnet link:
magnet:?xt=urn:btih:673c0c7f8e46e1902cea1071d5ce602bd307605b&dn=devuan_excalibur&tr=udp%3A%2F%2Ftracker.opentrackr.org%3A1337%2Fannounce&tr=udp%3A%2F%2F9.rarbg.me%3A2710%2Fannounce&tr=udp%3A%2F%2Ftracker.cyberia.is%3A6969%2Fannounce&tr=udp%3A%2F%2Ftracker.port443.xyz%3A6969%2Fannounce&tr=http%3A%2F%2Ftracker3.itzmx.com%3A6961%2Fannounce&tr=udp%3A%2F%2Ftracker.moeking.me%3A6969%2Fannounce&tr=http%3A%2F%2Fvps02.net.orel.ru%3A80%2Fannounce&tr=http%3A%2F%2Ftracker.openzim.org%3A80%2Fannounce&tr=udp%3A%2F%2Ftracker.skynetcloud.tk%3A6969%2Fannounce&tr=https%3A%2F%2F1.tracker.eu.org%3A443%2Fannounce&tr=https%3A%2F%2F3.tracker.eu.org%3A443%2Fannounce&tr=http%3A%2F%2Fre-tracker.uz%3A80%2Fannounce&tr=https%3A%2F%2Ftracker.parrotsec.org%3A443%2Fannounce&tr=udp%3A%2F%2Fexplodie.org%3A6969%2Fannounce&tr=udp%3A%2F%2Ftracker.filemail.com%3A6969%2Fannounce&tr=udp%3A%2F%2Ftracker.nyaa.uk%3A6969%2Fannounce&tr=udp%3A%2F%2Fretracker.netbynet.ru%3A2710%2Fannounce&tr=http%3A%2F%2Ftracker.gbitt.info%3A80%2Fannounce&tr=http%3A%2F%2Ftracker2.dler.org%3A80%2Fannounce

My apologies for any inconvenience,
fsmithred

+1

Best,

A.