Download the Signing Key for Kicksecure KVM

From Kicksecure
Jump to navigation Jump to search

Get Kicksecure KVM signing key. Verify Kicksecure KVM.


Since all Kicksecure KVM releases are signed with the same key, it is unnecessary to verify the key every time a new release is announced. Trust in the key might gradually increase over time, but cryptographic signatures must still be verified every time a new release is downloaded.

This page is strongly related to the Placing Trust in Kicksecure page.

Download the OpenPGP Key[edit]

Optional: Complete the steps below if unfamiliar with GnuPG or if they haven't already been performed. This will fix eventual gpg: WARNING: unsafe ownership warnings.

Have GnuPG initialize your user data folder.

gpg --fingerprint

Set warning free permissions.

chmod --recursive og-rwx ~/.gnupg

1. Securely download Kicksecure KVM developer HulaHoop's OpenPGP key. [1]
Download Kicksecure KVM Developer OpenPGP Key

2. Store the key as hulahoop.asc.

3. Check fingerprints/owners without importing anything.

gpg --keyid-format long --import --import-options show-only --with-fingerprint hulahoop.asc

4. Verify the output.

The most important check is confirming the key fingerprint exactly matches the output below. [2]

      Key fingerprint = 04EF 2F66 6D36 C354 058B  9DD4 50C7 8B6F 9FF2 EC85

The message gpg: key 50C78B6F9FF2EC85: 1 signature not checked due to a missing key is related to the The OpenPGP Web of Trust. Advanced users can learn more about this below.

warning Warning:

Do not continue if the fingerprint does not match! This risks using infected or erroneous files! The whole point of verification is to confirm file integrity.

5. Import the key.

gpg --import hulahoop.asc

The output should include the key was imported.

gpg: Total number processed: 1
gpg:               imported: 1

If the Kicksecure signing key was already imported in the past, the output should include the key is unchanged.

gpg: Total number processed: 1
gpg:              unchanged: 1

If the following message appears at the end of the output.

gpg: no ultimately trusted keys found

This extra message does not relate to the Kicksecure signing key itself, but instead usually means the user has not created an OpenPGP key yet, which is of no importance when verifying virtual machine images.

Analyze the other messages as usual.

6. Advanced users can check Web of Trust further below for better security.

7. Complete the Kicksecure verification steps.

If verifying Kicksecure images, navigate to the relevant verification page below to finish the process:

OpenPGP Key Features[edit]

  • sign/verify Kicksecure KVM images: yes
  • sending encrypted e-mails to Kicksecure KVM developer HulaHoop: no

Advanced Users[edit]

OpenPGP Web of Trust[edit]

Advanced users only!

HulaHoop's OpenPGP key can be verified through The OpenPGP Web of Trust. Kicksecure Patrick Schleizer's (adrelanos') has OpenPGP signed Kicksecure KVM developer HulaHoop's OpenPGP key.

1. First, acquire Patrick's signing key.

Refer the the more secure, detailed Kicksecure Main, VirtualBox, APT Repository and Source Code Signing Key instructions.

2. Verify the key was also signed by Kicksecure lead developer Patrick Schleizer.

gpg --check-sigs "04EF 2F66 6D36 C354 058B 9DD4 50C7 8B6F 9FF2 EC85"

The output should be identical to the message below.

pub   rsa4096/0x50C78B6F9FF2EC85 2018-11-26 [SCEA]
uid                   [ unknown] HulaHoop
sig!         0x8D66066A2EEACCDA 2018-12-14  Patrick Schleizer <>
sig!3        0x50C78B6F9FF2EC85 2018-11-26  HulaHoop
sub   rsa4096/0xEB27D2F8CEE41ACC 2018-11-26 [SEA]
sig!         0x50C78B6F9FF2EC85 2018-11-26  HulaHoop

gpg: 3 good signatures

Download the signify Key[edit]

Info Advanced users only!


untrusted comment: signify public key

Further Reading[edit]


When a GPG error is encountered, first try a web search for the relevant error. The security stackexchange can also help to resolve GPG problems. Describe the problem thoroughly, but be sure it is GPG-related and not specific to Kicksecure.

More help resources are available on the Support page.

See Also[edit]


Kicksecure KVM/Project Signing Key wiki page Copyright (C) Amnesia <amnesia at boum dot org>
Kicksecure KVM/Project Signing Key wiki page Copyright (C) 2012 - 2024 ENCRYPTED SUPPORT LP <

This program comes with ABSOLUTELY NO WARRANTY; for details see the wiki source code.
This is free software, and you are welcome to redistribute it under certain conditions; see the wiki source code for details.


  1. curl --tlsv1.3 --max-time 180 --output ~/hulahoop.asc
  2. Minor changes in the output such as new uids (email addresses) or newer expiration dates are inconsequential.
    Hash: SHA512
    untrusted comment: signify public key
    -----END PGP SIGNATURE-----

Unfinished: This wiki is a work in progress. Please do not report broken links until this notice is removed, use Search Engines First and contribute improving this wiki.

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!