The minimal installation CD for amd64 does not seem to contain the release engineering keys that are required to verify the stage archive. The handbook instructs the user to run "gpg --verify" on the downloaded files, which returns "Can't check signature: No public key". Of course, the handbook could be updated to include instructions on downloading the relevant keys, similar to the section about downloading the ISO. But I believe they should be part of the installation media, because: 1. It would be easier for the user. Less steps mean probably fewer users skip them, resulting in more verified Gentoo installations. 2. Right now, the security-conscious user needs to get the keys from some keyserver and then compare the fingerprints to those published on the web site, checking that the HTTPS connection is good. With the keys on the installation media, no extra steps are needed to establish trust, since they are verified by checking the ISOs signature. 3. IMHO, the key needed to verify files downloaded during installation process simply belong on official installation media. Note: install-amd64-minimal-20190212T214502Z.iso is the only ISO I tested. May apply to other ISOs as well. Reproducible: Always Steps to Reproduce: 1. Download minimal installation CD 2. Follow the instructions in the handbook on downloading and verifying a stage archive Actual Results: Verification fails with: gpg: Signature made Fri Feb 22 01:45:08 2019 UTC gpg: using RSA key 13EBBDBEDE7A12775DFDB1BABB572E0E2D182910 gpg: Can't check signature: No public key Expected Results: The instructions in the handbook simply work :)
Yeah, that's a bug, here's the handbook page in question: https://wiki.gentoo.org/wiki/Handbook:Parts/Installation/Media
In @system now.
