kd4e No, you no longer need signify to verify the factory images. This is now done with OpenSSH as u/Space already wrote. (openssh-client should be installed on every Unix & Linux by default)

The current public key is signed with the previous signify key. If you already have the previous signify public key (factory.pub) and want to verify the new key with it:

curl -O https://releases.grapheneos.org/allowed_signers.sig
signify -V -m allowed_signers -x allowed_signers.sig -p factory.pub

When the current signing key is replaced, the new key will be signed with it.

If you don't have the previous signify public key, you can skip this section. Signify is only used to compare the old key with the new one.

  • kd4e replied to this.

    boldsuck

    OK, so I did this ...

    Verify the Image

    ssh-keygen -Y verify -f allowed_signers -I contact@grapheneos.org -n "factory images" -s DEVICE_NAME-factory-VERSION.zip.sig < DEVICE_NAME-factory-VERSION.zip

    Got this (plus a long key string) ...

    Good "factory images" signature for contact@grapheneos.org with ED25519 key SHA256

    But that key is not the same as this ...

    contact@grapheneos.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIUg/m5CoP83b0rfSCzYSVA4cw4ir49io5GPoxbgxdJE

      boldsuck

      The key that I'm getting is different than the one on github.

      I'm not sure why support is being scattered across so many different social media systems, rather than just one, it seems counter-intuitive to fragment the information. Sigh.

      I see that Chat via the Thunderbird email is one alternative - at least I don't have to add yet another app. (I had no idea Thunderbird even had a Chat feature.)

      I'll give it a try. I'd rather ask first than plow ahead, make a mess, then have to undo the mess and start over.

      Thanks.

        kd4e The chat rooms are bridged across Discord, Telegram and Matrix.
        Just click onGeneral:grapheneos.org, Matrix/Element starts in every browser.

        kd4e Signify isn't used as part of the current CLI install process. Use our official installation instructions instead of whatever unofficial guide you're following.

          • Edited

          GrapheneOS
          I was here:

          [(https://grapheneos.org/install/cli)]

          And read this ...

          The current public key is signed with the previous signify key. If you already have the previous signify public key (factory.pub) and want to verify the new key with it:

          curl -O https://releases.grapheneos.org/allowed_signers.sig
          signify -V -m allowed_signers -x allowed_signers.sig -p factory.pub

          When the current signing key is replaced, the new key will be signed with it.

            kd4e As @boldsuck mentioned, they're essentially the same chat rooms whether you use Discord, Matrix, Telegram or IRC due to the bridge. We support multiple chat platforms officially since if we don't people are still going to make communities on each of them, which would end up filled with misinformation and malicious people trying to harm GrapheneOS. By making rooms on each major platform ourselves, we avoid that situation. There's also an unofficial group on SimpleX created by some of our moderators created which cannot be official due to technical limitations which may end up being resolved in the next couple years. It was created to replace a previous unofficial group with absolutely no moderation at all which was filled with trolls and misinformation, which is how we get pushed into supporting more chat platforms.

            kd4e This information is only for people who previously used the older instructions with signify and therefore already have the previous signify key which they can use to verify the newer OpenSSH key. The switch to OpenSSH signing was done in February and at some point we can remove the instructions on verifying the key rotation. If you're starting fresh, you have no use for this.

            When I power on the phone while holding the volume Down - on the phone display where it shows Fastboot Mode it also shows ...

            Device State: locked

            In Developer options OEM unlocking is ON.

            I tried turning on USB debugging and USB file transfer ... no Unlock Bootloader Screen in Web Installer.

            Oh, wait, for some reason this doesn't work with Firefox - just remembered that.

            Sigh, OK, I'll have to move to a different computer.

            OK, got to the "Download release" step ...

            Error: undefined

            ???

            I have a good Internet connection.

            • de0u replied to this.

              kd4e OK, got to the "Download release" step ...

              Error: undefined

              That could mean many things. Probably the single most likely thing is an unsupported or out-of-date browser.

              • kd4e replied to this.

                de0u

                Chromium Version 125.0.6422.141 Official Build Built on Debian 12.5 Running on Debian 12.5 (64 bit)

                Latest version of MX Linux 23.3 and I just ran an update to be sure of everything.

                • de0u replied to this.

                  kd4e Latest version of MX Linux 23.3 and I just ran an update to be sure of everything.

                  It is possible that MX Linux is not on the GrapheneOS list of supported install platforms because something goes wrong with the web installer.

                  • kd4e replied to this.
                    • Edited

                    de0u

                    Chromium is OS sensitive?

                    I thought Chromium was essentially self-contained.

                    Why would it be able to do 'Unlock bootloader' (communicate with the phone) but not 'Download release' (communicate with the Internet)?

                    'Download release' would seem a generic browser activity.

                    I just tried and no problem downloading a .wav file from the Internet.

                    Could I manually download the 'release' then 'flash' it?

                    Oh, wait, that would loop me back to the OpenSSH signing problem ... sigh.

                    • de0u replied to this.

                      kd4e Chromium is OS sensitive?

                      I thought Chromium was essentially self-contained.

                      Unfortunately, many things have the ability to break other things. After a problem has been solved it may seem obvious in retrospect that what went wrong could have gone wrong.

                      kd4e Why would it be able to do 'Unlock bootloader' (communicate with the phone) but not 'Download release' (communicate with the Internet)?

                      'Download release' would seem a generic browser activity.

                      I just tried and no problem downloading a .wav file from the Internet.

                      What the installer does is not the same thing as when the browser downloads a file to store in the file system for you to use later. It is fetching the contents across the Internet, storing it in a special temporary file, and then sending the contents of the file over WebUSB.

                      kd4e I just tried and no problem downloading a .wav file from the Internet.

                      Maybe the problem is insufficient temporary space, which is something various Linux distributions configure differently.

                        de0u

                        OK, reconfigured things and now have a new error ...

                        "Error: Failed to execute 'open' on 'USBDevice': Access denied."

                          kd4e

                          Note: It did correctly identify the phone as a Pixel 7a and the matching the Lynx version of the image.