Expired project signature keys in documentation?

English Install/Boot/Login
1

Hey. I’m new to this forum and I’m not 100% sure if this is the right place to post this so please be gentle.

I was going through the steps of making a Tumbleweed installation media and got to the point of checking the authenticity of the downloads with the project signing key but the key mentioned in the Download help-page expired last month. (https://en.opensuse.org/SDB:Download_help#Checksums). Also on this page only the expired project signing key is mentioned (https://en.opensuse.org/openSUSE:Signing_Keys).

Is the documentation on these pages outdated or am I missing something obvious? Where can I find the current project signing key to verify my installation files? I’m currently using Linux Mint btw so I don’t have the keys anywhere else on my system.

2

Are you simply wanting to check the integrity of the downloaded ISO, before burning it to a thumbdrive / etc??

If Yes, simply run the sha* command at the command line

. To show what I have, I show a file listing
. Next, I check using the sha512sum command for its ISO
. Finally, I check using the sha256sum command for its ISO

Both report OK, so the ISO files are verified.

myswtest@mine:~/vms> ll *.iso*
-rw-r--r--  Leap-16.0-offline-installer-x86_64-Build178.27.install.iso
-rw-r--r--  Leap-16.0-offline-installer-x86_64-Build178.27.install.iso.sha512

-rw-r--r--  Leap-16.1-offline-installer-x86_64-Build33.6.install-0612.iso
-rw-r--r--  Leap-16.1-offline-installer-x86_64-Build33.6.install.iso-0612.sha512

-rw-r--r--  openSUSE-Leap-15.6-DVD-x86_64-Build710.3-Media.iso
-rw-r--r--  openSUSE-Leap-15.6-DVD-x86_64-Build710.3-Media.iso.sha256
myswtest@mine:~/vms> 
myswtest@mine:~/vms> 
myswtest@mine:~/vms> sha512sum -c Leap-16.0-offline-installer-x86_64-Build178.27.install.iso.sha512 
Leap-16.0-offline-installer-x86_64-Build178.27.install.iso: OK

myswtest@mine:~/vms> 
myswtest@mine:~/vms> sha256sum -c openSUSE-Leap-15.6-DVD-x86_64-Build710.3-Media.iso.sha256
openSUSE-Leap-15.6-DVD-x86_64-Build710.3-Media.iso: OK

myswtest@mine:~/vms>

.
Or, I may have misunderstood what your request is … if Yes, let us know. :+1:

1 Like
3

Sorry, I think my original message was a bit poorly worded. What I meant is that I had issues verifying the files GPG signatures since I don’t know where to get the current public key. I have no issues with checking the hashes. Thanks!

4

First try this:

sudo zypper clean -a
sudo zypper ref -f
1 Like
5

I’m currently using Linux Mint so that’s not an option sadly.

6

Ok, so I found this Reddit thread (https://www.reddit.com/r/openSUSE/comments/1ue7jf4/signing_key_expired/) about the same issue from a month ago where user FilippoBonazziSUSE managed to shed some light into the issue:

Yeah validity of GPG signing key AD485664E901B867051AB15F35A2F86E29B700A4 was recently extended to 2030-05-27 via an update to the openSUSE-build-key package (the new key file should be under /usr/lib/rpm/gnupg/keys/gpg-pubkey-29b700a4-62b07e22.asc on an up-to-date Tumbleweed) but due to a bug somewhere it has not been automatically imported into the GPG database. So gpg --list-key AD485664E901B867051AB15F35A2F86E29B700A4 still shows the key as expired on 2026-06-19. This is being looked into.

Note that the fact that the key has just recently expired does not invalidate the valid GPG signature on ISOs and other artifacts. It does look bad, but it’s just an unfortunate temporary hiccup which was not supposed to happen and will hopefully be resolved soon.

This gives me enough reassurance that I can proceed with the installation. Let’s hope that the underlying issue will get fixed soon. Thank you all for your time!