digilent adept runtime package header is not signed

[aminoh]

My objective is to try the WaveForms software before making a purchase. I have an openSUSE installed on machine. First I am supposed to install the digilent.adept.runtime-2.27.9-1.x86_64 which I can do with this command:

`sudo zypper install PATH_TO_RPM_FILE`

though I receive an error message stating:

Quote

Package header is not signed!
digilent.adept.runtime-2.27.9-1.x86_64 (Plain RPM files cache): Signature verification failed [6
-File is unsigned]
 

[Fausto]

Hello @aminoh.

Hello, I have moved your thread to a more appropriate section of the Forum where the WaveForms developer may be able to provide some insight into this.

Regards,

Fausto

[attila]

Hi @aminoh

The digilent rpm packages are not signed, select ignore.

[aminoh]

Hey @attila thanks for your prompt answer :)
I wonder though is there any particular reason for this? Normally I would never install any packages which are not signed.

[malexander]

@aminoh

I briefly looked into this and resolving this issue seems fairly straight forward. I believe we just need to generate a GPG key, sign the package, and publish our public key on our website so that users can import it. Which version of OpenSUSE are you running? I'd like to spin it up in a VM verify the process.

Thanks,
Michael

[aminoh]

@malexander Thanks :) I am running an openSUSE Tumbleweed with version id 20240314. My machine is a x86_64.

That's very nice of you,

Amin

[attila]

Hi @aminoh

The waveforms rpm is signed in the latest version:

The adept runtime release should be updated soon.
In the future the Linux packages will be signed automatically by the build script.
Thank you for the observation.

[malexander]

@aminoh

I was having trouble getting OpenSUSE to work in VMWare so I was unable to verify that the error goes away. However, I have signed and re-uploaded all of the RPM and DEB packages for the Adept Runtime and Adept Utilities to our website. You will need to import our public GPG key, which I've attached here. Hopefully, that key will be published on our website soon.

Thanks,
Michael

digilent_public_key.asc

[aminoh]

Thanks very much :)

So far I managed to install the adept runtime signed and all.

[Kevin.C]

Hi! 

Where can I find the public key? 

[Kevin.C]

Hi! 

Where can I find the public key? @attila

[malexander]

@Kevin.C

The GPG keys are on the download page next to the software they are applicable to:

[Kevin.C]

21 hours ago, malexander said:

@Kevin.C

The GPG keys are on the download page next to the software they are applicable to:

Hey @malexander, just now seeing this! 

I'm unable to where exactly this is available after surfing through multiple download pages. Could you provide a link for Digilent Waveforms? 
 

[malexander]

@Kevin.C I don't see it for WaveForms 3.22.2 but the public key should be the same as the one used for Adept so please try that one.

@attila did you go back and sign and re-upload the existing stable release of WaveForms for Linux or are you only signing new releases?

[attila]

Hi @malexander

Only the new builds are signed, since 3.22.14, with the same key as adept.