1

These are the steps I took:

  1. open https://suite.trezor.io/

  2. download the 3 files: Desktop app, signature and signing key

  3. follow the instructions https://wiki.trezor.io/Apps:Trezor_Suite#How_to_run, How to verify the binaries,2 terminal commands.

/Downloads$ gpg --import satoshilabs-2021-signing-key.asc
gpg: key E21B6950A2ECB65C: 1 signature not checked due to a missing key
gpg: key E21B6950A2ECB65C: "SatoshiLabs 2021 Signing Key" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1
~/Downloads$ gpg --verify Trezor-Suite-21.12.2-linux-x86_64.AppImage.asc
gpg: assuming signed data in 'Trezor-Suite-21.12.2-linux-x86_64.AppImage'
gpg: Signature made Wed 08 Dec 2021 10:45:00 AM MST
gpg:                using RSA key EB483B26B078A4AA1B6F425EE21B6950A2ECB65C
gpg: Good signature from "SatoshiLabs 2021 Signing Key" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: EB48 3B26 B078 A4AA 1B6F  425E E21B 6950 A2EC B65C

Question: Can I still trust the Suite?

Thanks

1 Answer 1

1

Question: Can I still trust the Suite?

Yes. GPG indicates that there is a valid signature for SatoshiLab's signing key.

GPG has a thing called the "trust database" (trustdb). This is a local database of keys that you have told GPG that you trust, with trust meaning that you have verified that the owner of that key is who the key says it belongs to. By default, keys are not trusted or have an unknown trust value as you have to verify the identity externally, and then inform GPG.

So the warning that you see is simply GPG telling you that this particular key does not have a trusted value in the trustdb. You have not told GPG that you trust this key, and it is merely reminding you of this fact.

1
  • Thank you for the answer. I'd recommend Satoshi Labs to include this information in their instructions so newbies don't panic :)
    – Sil
    Dec 20, 2021 at 23:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.