9.2 ISO verification, and best practices security wise

[oslmKam]

Hi, new to these forums, hoping to both help and reviece help in the future.

Currently trying to structure a plan for a future server with Proxmox as the base.

To try best practices, both admin ways and security wise, therefore following the official docs.

Security is both fun and interesting, so performing 0 trust, always verify is a practice.

At the Proxmox Download Page, there is a SHA256SUM that can be verified to ensure integrity. From my memory it is often reccommended to also use GPG for web of trust, and the official page should display their GPG key publically. Is there any reason for proxmox to not use GPG keys?

No GPG fingerprint information is available at either the wiki or the docs. Does that exist? I found however enterprise.proxmox.com/iso/which shares the .ASC, but no links in the official docs/wiki.

Also https://download.proxmox.com have: net::ERR_CERT_COMMON_NAME_INVALID.

 

[oslmKam]

Update; I found a link to https://pbs.proxmox.com/docs/installation.html#secureapt which shows https://enterprise.proxmox.com/debian/proxmox-archive-keyring-trixie.gpg . Nothing for the ISO itself.

 

[cheiss]

I found however enterprise.proxmox.com/iso/ which shares the .ASC, but no links in the official docs/wiki.

Yes, this is the alternative website. At the end of the site, you can find the specific verification for both the checksum and signature.

It's documented e.g. here for Proxmox VE: https://pve.proxmox.com/wiki/Downloads
Which is also linked to on the website for each download, e.g.: https://proxmox.com/en/downloads/proxmox-virtual-environment/iso/proxmox-ve-9-2-iso-installer

 

[Stereoscope]

When I run the command:

gpgv --keyring ./proxmox-release-trixie.gpg \
proxmox-ve_9.2-1.iso.asc proxmox-ve_9.2-1.iso

I'm getting:

gpgv: Signature made Thu 21 May 21:45:16 2026 AEST
gpgv:                using RSA key 24B30F06ECC1836A4E5EFECBA7BCD1420BFE778E
gpgv: Good signature from "Proxmox Trixie Release Key <proxmox-release@proxmox.com>"
gpgv: Signature made Thu 21 May 21:45:22 2026 AEST
gpgv:                using RSA key F4E136C67CDCE41AE6DE6FC81140AF8F639E0C39
gpgv: Can't check signature: No public key

Why is it running checks against Bookworm if my command is only talking about 9.2-1 and not the Bookworm Proxmox version?

 

[LnxBil]

The signature file contains two signatures, one from bookworm and one from trixie:

$ gpg --list-packets proxmox-ve_9.2-1.iso.asc
# off=0 ctb=89 tag=2 hlen=3 plen=563
:signature packet: algo 1, keyid A7BCD1420BFE778E
        version 4, created 1779363916, md5len 0, sigclass 0x00
        digest algo 8, begin of digest 61 ae
        hashed subpkt 33 len 21 (issuer fpr v4 24B30F06ECC1836A4E5EFECBA7BCD1420BFE778E)
        hashed subpkt 2 len 4 (sig created 2026-05-21)
        subpkt 16 len 8 (issuer key ID A7BCD1420BFE778E)
        data: [4096 bits]
# off=566 ctb=89 tag=2 hlen=3 plen=563
:signature packet: algo 1, keyid 1140AF8F639E0C39
        version 4, created 1779363922, md5len 0, sigclass 0x00
        digest algo 8, begin of digest ce 5e
        hashed subpkt 33 len 21 (issuer fpr v4 F4E136C67CDCE41AE6DE6FC81140AF8F639E0C39)
        hashed subpkt 2 len 4 (sig created 2026-05-21)
        subpkt 16 len 8 (issuer key ID 1140AF8F639E0C39)
        data: [4095 bits]

And checking with each shows of course one error and one successfull verification:

$ gpgv --keyring /tmp/proxmox-release-trixie.gpg proxmox-ve_9.2-1.iso.asc proxmox-ve_9.2-1.iso
gpgv: Signature made Thu May 21 13:45:16 2026 CEST
gpgv:                using RSA key 24B30F06ECC1836A4E5EFECBA7BCD1420BFE778E
gpgv: Good signature from "Proxmox Trixie Release Key <proxmox-release@proxmox.com>"
gpgv: Signature made Thu May 21 13:45:22 2026 CEST
gpgv:                using RSA key F4E136C67CDCE41AE6DE6FC81140AF8F639E0C39
gpgv: Can't check signature: No public key


$ gpgv --keyring /tmp/proxmox-release-bookworm.gpg proxmox-ve_9.2-1.iso.asc proxmox-ve_9.2-1.iso
gpgv: Signature made Thu May 21 13:45:16 2026 CEST
gpgv:                using RSA key 24B30F06ECC1836A4E5EFECBA7BCD1420BFE778E
gpgv: Can't check signature: No public key
gpgv: Signature made Thu May 21 13:45:22 2026 CEST
gpgv:                using RSA key F4E136C67CDCE41AE6DE6FC81140AF8F639E0C39
gpgv: Good signature from "Proxmox Bookworm Release Key <proxmox-release@proxmox.com>"

So it works as it should.

If you want everything to be perfect, use only one signature or combine both keyrings. The later is like this:

# Export both keys
$ gpg --keyring /tmp/proxmox-release-bookworm.gpg --export --armor > /tmp/bookworm.gpg
$ gpg --keyring /tmp/proxmox-release-trixie.gpg --export --armor > /tmp/trixie.gpg

# Import in new keyring
$ gpg --no-default-keyring  --keyring /tmp/proxmox.gpg --import /tmp/bookworm.gpg
gpg: key 1140AF8F639E0C39: public key "Proxmox Bookworm Release Key <proxmox-release@proxmox.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1

$ gpg --no-default-keyring  --keyring /tmp/proxmox.gpg --import /tmp/trixie.gpg
gpg: key A7BCD1420BFE778E: public key "Proxmox Trixie Release Key <proxmox-release@proxmox.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1

# Final check (besides the trusted part, both signatures are now "goog"
$ gpg --keyring /tmp/proxmox.gpg --verify proxmox-ve_9.2-1.iso.asc proxmox-ve_9.2-1.iso
gpg: Signature made Thu May 21 13:45:16 2026 CEST
gpg:                using RSA key 24B30F06ECC1836A4E5EFECBA7BCD1420BFE778E
gpg: Good signature from "Proxmox Trixie Release Key <proxmox-release@proxmox.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 24B3 0F06 ECC1 836A 4E5E  FECB A7BC D142 0BFE 778E
gpg: Signature made Thu May 21 13:45:22 2026 CEST
gpg:                using RSA key F4E136C67CDCE41AE6DE6FC81140AF8F639E0C39
gpg: Good signature from "Proxmox Bookworm Release Key <proxmox-release@proxmox.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: F4E1 36C6 7CDC E41A E6DE  6FC8 1140 AF8F 639E 0C39

 

[Stereoscope]

I only looked at the "proxmox-ve_9.2-1.iso.sha256" file, saw only one hash and assumed the asc file also only had one signature. Never seen a dual signature signature before. Makes sense now! Never assume as they say. Thanks.