Bitcoin Forum

Hello

I downloaded "Kleopatra".
Then i copy "public key" from https://raw.githubusercontent.com/spesmilo/electrum/master/pubkeys/ThomasV.asc.
Then i pasted all of them into "Kleopatra" by "certificate import" button:
I got this:

http://s8.picofile.com/file/8357095234/thomas.jpg

Then i downloaded "electrum-3.3.4-setup.exe" & "electrum-3.3.4-setup.exe.asc" from https://electrum.org/#download
Then i put both of them in the same folder
Then i click on "decrypt/verify" button and choose "electrum-3.3.4-setup.exe.asc".
Finally i got this:
The data could not be verified

http://s8.picofile.com/file/8357095250/thomas_2.jpg

Is everything OK or i did something wrong?
Is the signature matches with the files?

I did also the above instruction with "Electron cash" and got the same thing.

This just means that you haven't manually trusted ThomasV's key. The signatures are matching.

Right-click on ThomasV's name and select "Certificate"; Follow the quick steps and his "User-ID" will change from "not certified" to "certified";
Then, do the verification again and it will show a green message.

Alternatively, simply click the "Show Audit Log" link shown in your screenshot... it'll show the commandline output... you should see:
You can safely ignore the "warning: this key is not certified with a trusted signature", as TryNinja explained, it just means that you haven't personally trusted ThomasV's signature ;)

Again, as long as you see the bold line that says: "gpg: Good signature", then everything is OK.

---

For the record, if the signature was "invalid", Kleopatra would warn you with a big red highlight like this:
https://talkimg.com/images/2023/11/15/zB18T.png

"Invalid Signature"... and "Bad Signature"... and in the "show audit log" (or on the commandline), you'd see:

This is not completely accurate. Two conditions must be met:
1. Absence of “Bad Signature” or “Invalid Signature”
AND
2. The key must match the 6694 D8DE 7BE8 EE56 31BE D950 2BD5 824B 7F94 70E6 (or 2BD5 824B 7F94 70E6).

Fake signature example:
https://d.radikal.ru/d28/1904/e2/965d2b5d584c.png

First time verifying and I think i followed the instructions correctly, double checking that this output is OK.

There is no "Bad/Invalid" and it says "good signature" and the fingerprint matches so I am guessing the difference is trivial, but i get an audit log without 2 of Thomas V's aliases:

The primary key fingerprint matches and the signature returned “good”, so that’s what matters. You are fine.

Thank you.