Our Authentication & Quality Assurance Procedure For Creating QubesOS Media

Step 1:

cd Downloads

Step 2:

mkdir qubes

Step 3: Download the latest version of QubesOS from https://www.qubes-os.org/ (or a mirror)

wget https://mirrors.edge.kernel.org/qubes/iso/Qubes-R4.3.1-x86_64.iso

wget https://mirrors.edge.kernel.org/qubes/iso/Qubes-R4.3.1-x86_64.iso.asc

wget https://mirrors.edge.kernel.org/qubes/iso/Qubes-R4.3.1-x86_64.iso.DIGESTS

Step 4: Check the qubes-os.org news section for a warrant canary and look for “The Qubes Master Signing Key fingerprint is:” message to confirm the recv-keys in the gpg2 command below is the correct fingerprint.

Step 5: Also check a 2nd source:

curl -s https://www.mail-archive.com/qubes-devel@googlegroups.com/msg04908.html | tr -d ' \n' | grep -oP '427F11FD0FAA4B080123F01CDDFA1A3E36879494'
gpg2 --keyserver-options no-self-sigs-only,no-import-clean \
--keyserver hkp://keyserver.ubuntu.com \
--recv-keys 427F11FD0FAA4B080123F01CDDFA1A3E36879494

Step 6:

gpg2 --keyserver-options no-self-sigs-only,no-import-clean \
--fetch-keys https://keys.qubes-os.org/keys/qubes-release-4.3-signing-key.asc

Step 7:

gpg2 --check-sigs 1C3D9B627F3FADA4

Step 8:

gpg2 -v --verify Qubes-R4.3.1-x86_64.iso.asc Qubes-R4.3.1-x86_64.iso

Step 9:

sudo fdisk -l

Step 10: Dismount any partitions if they exist on the flash drive

umount /dev/sda1
umount /dev/sda2
umount /dev/sda3

Step 11: Write the image

sudo dd if=Qubes-R4.3.1-x86_64.iso of=/dev/sda bs=4M

Step 12:

sync

Step 13: Identify the size of the ISO using the stat command:

stat -c '%s' Qubes-R4.3.1-x86_64.iso

8402513920

Step 14: Along with the above number output use the head command to check the portion of the disk we've written the ISO to Prior to running this command it isn't a bad idea to unplug the USB drive and connect it again

sudo head -c 8402513920 /dev/sda | sha256sum

6ab99dee2c7a7b2c32053d3531084aaf3af703815842b67f90a87ba324527db6 -

Step 15: Make sure the output above matches what is in the hash file we downloaded earlier:

cat Qubes-R4.3.1-x86_64.iso.DIGESTS

6ab99dee2c7a7b2c32053d3531084aaf3af703815842b67f90a87ba324527db6 *Qubes-R4.3.1-x86_64.iso
453699a42b85a9dcf33434b9da419e43001ce30b6014befc26f4fbb1cbf70fd30bc9b479b4499d64de29daae9edaf73b4b78b92e32379e11287d017293b95893 *Qubes-R4.3.1-x86_64.iso