Windows: Unable to verify GrapheneOS zip files

dapofi2471

On Windows machine trying to verify latest images using published instructions

C:\GrapheneOS> ssh-keygen -Y verify -f allowed_signers -I contact@grapheneos.org -n "factory images" -s tegu-install-2025112100.zip.sig < tegu-install-2025112100.zip

Signature verification failed: incorrect signature
Could not verify signature

23Sha-ger

I suggest you use the web installer, it offers zero trust install.

//
Regarding verifying, you must download the key signature file first and make sure it is in the folder you are running the check from. Otherwise ssh has no file to verify it against.

dapofi2471

Unfortunately, the web installer is not an option. Must install using CLI.
How to verify the factory images.
see also, https://grapheneos.org/install/cli

Watermelon

Make sure you use the command for Windows, which is different than the command for Linux/macOS, as I saw in the official instructions. If it fails, redownload the signature file. If it fails, redownload the zip file.

dapofi2471

Watermelon
I re-downloaded both files. Same error appears, see my first post for commands and output.

Are the files properly signed?
Can someone execute on Windows machine and post command output?

dapofi2471

dapofi2471
Update: Binary integrity verification successful :-)

C:\WINDOWS\system32> chdir 'C:\GrapheneOS'
C:\GrapheneOS> dir | findstr tegu
2025-11-25 17:18 <DIR> tegu-install-2025112100
2025-11-25 17:14 1,668,372,115 tegu-install-2025112100.zip
2025-11-25 17:16 310 tegu-install-2025112100.zip.sig

C:\GrapheneOS> ssh-keygen -Y verify -f allowed_signers -I contact@grapheneos.org -n "factory images" -s tegu-install-2025112100.zip.sig < tegu-install-2025112100.zip

Good "factory images" signature for contact@grapheneos.org with ED25519 key SHA256:AhgHif0mei+9aNyKLfMZBh2yptHdw/aN7Tlh/j2eFwM

23Sha-ger

Amazing. Keep us updated.