Building and Securing a Host OS

2.1.1. Verify the Integrity

2.1.2. (Optional) Export a JSON manifest for documentation and verification auditing.

{
    "IsoSha512":  "873E9AA09A913660B4780E29C02419F8FB91012C8092E49DCFE90EA802E60C82DCD6D7D2BEEB92EBCA0570C49244EEE57A37170F178A27FE1F64A334EE357332",
    "IsoFile":  "debian-13.1.0-amd64-netinst.iso",
    "Timestamp":  "2025-09-13T10:23:33-06:00",
    "ChecksumFile":  "SHA512SUMS",
    "SigFile":  "SHA512SUMS.sign"
}

2.1.3. (Optional, recommended) Verify the Authenticity

1. Install GPG using Windows Package Manager, winget:
   

   First, we want to ensure we are protecting ourselves against Typo Squatting, where a bad actor will use a common mis-spelling of a package to distribute malware.

   Package Manager

   Handles repository management and automatically resolves package dependencies. Think of it as an app store for your terminal; it handles finding, installing, and updating software.

   We will search for the software by name;

   winget search "Gnu Privacy Guard"
   

   It should return something similar to:

   Name              Id          Version Source
   ---------------------------------------------
   GNU Privacy Guard GnuPG.GnuPG 2.4.8   winget
   

   Any results cannot be blindly trusted and must be independently verified, we will show to get a detailed report of the search results.

   winget show GnuPG.GnuPG
   

   This search will yield multiple results. Before installing anything, it is critical to vet the package to avoid security risks like typo squatting, where malicious actors upload packages with names similar to legitimate ones. We can inspect the full details of a package using winget show to find the Id, Publisher, and Homepage fields.

   For each of the fields, these are unverified claims until independantly vetting using the following process:

   1. Corroborate: Do not blindly trust and navigate to the Homepage URL listed in the manifest. Instead, use an independent search engine to find the software's official project website. This is the non-negotiable step to establish a ground truth.
   2. Verify: Compare the Publisher name and package Id from the manifest against the official developer or organization name found on the official website. Any discrepancy, however minor, is a red flag that should halt the installation.
   3. Execute: Only after you have independently verified that the manifest's claims align with the official source, proceed with the installation using the precise command: winget install --id <PackageId> --exact.

   Once verified, we can safely install;

   winget install GnuPG.GnuPG
   

   This time, since we used a package manager, we will not need to verify the integrity of the download using the hashes, as this is done automatically for us, and you have already authenticated the package in the previous step.

   After installing a package, winget hands control over to that package installer. The installer itself is responsible for everything from where the program is placed on your hard drive to whether it adds shortcuts, registers file associations, and modifies the system's PATH environment variable. Some installers, especially for developer tools like GnuPG, assume you will handle this part yourself, as it can be a source of problems if not done correctly.

   To do this, we will need to exit our existing PowerShell Session (type exit, then "Enter\"), then open an additional PowerShell Terminal as an Administrator using: Win+x a. This ensures we have the permissions needed to modify the system PATH.

   First, verify if the package was added to PATH:

   Get-Command gpg
   

   If you get an error that gpg is not found this does not mean the installation failed, but rather that we haven't told the system where to find it.

   If it isn't found, paste in this script,

   $GpgExe = Get-ChildItem -Path "C:\Program Files*" -Filter "gpg.exe" -Recurse -ErrorAction SilentlyContinue | Select-Object -First 1
   if ($GpgExe) {
       $GpgDir = Split-Path -Parent $GpgExe.FullName
       [Environment]::SetEnvironmentVariable("PATH", $Env:PATH + ";" + $GpgDir, [EnvironmentVariableTarget]::Machine)
       Write-Host "GPG added to PATH: $GpgDir" -ForegroundColor Green
   } else {
       Write-Host "GPG installation not found" -ForegroundColor Red
       exit 1
   }
   

   Or; Want to roll your own? Use these instructions. Always eyeball the result before you paste into a terminal. We need to locate where the installer downloaded the application to:

   Get-ChildItem -Path "C:\Program Files*" -Filter "gpg.exe" -Recurse -ErrorAction SilentlyContinue
   

   The -ErrorAction SilentlyContinue part just tells PowerShell not to show you any "Access Denied" errors it might encounter when trying to look inside protected system folders. The result should list a Directory location, such as:

       Directory: C:\Program Files (x86)\gnupg\bin
   
   Mode                 LastWriteTime         Length Name
   ----                 -------------         ------ ----
   -a---          9/13/2025  10:23 AM         123456 gpg.exe
   

   Copy the Directory path (in this case: `C:\Program Files (x86)\gnupg\bin`) for the next step, adding the Directory path to the system PATH:

   [System.Environment]::SetEnvironmentVariable(
       "PATH", $env:PATH + ";" + "__GPGPATH__", [EnvironmentVariableTarget]::Machine)
   

   GPG Path:
   

   Refresh the environment variables for the PATH modification to take effect:

   refreshenv
   

   Now, we can confirm the installation:

   gpg --version
   

2. Verification Using GPG
   

   Then, import Debian’s official signing keys. The provider key IDs we're importing are Debian’s official signing keys but you should never trust them just because a tutorial says so.

   → Verify them yourself on Debian’s official site.

   We’ll use the 3 CD release signing keys listed:

   gpg --keyserver keyserver.ubuntu.com --recv-keys 988021A964E6EA7D DA87E80D6294BE9B 42468F4009EA8AC3
   

   gpg: C:\\Users\\caleb\\AppData\\Roaming\\gnupg\\trustdb.gpg: trustdb created
   gpg: key 42468F4009EA8AC3: public key "Debian Testing CDs Automatic Signing Key <[email protected]>" imported
   gpg: key DA87E80D6294BE9B: public key "Debian CD signing key <[email protected]>" imported
   gpg: key 988021A964E6EA7D: public key "Debian CD signing key <[email protected]>" imported
   gpg: Total number processed: 3
   gpg:               imported: 3
   

   After importing the keys, verify the signature:

   gpg --verify SHA512SUMS.sign SHA512SUMS
   

   The output will likely look like this:

   gpg: Signature made 09/06/25 15:54:29 Mountain Daylight Time
   gpg:                using RSA key DF9B9C49EAA9298432589D76DA87E80D6294BE9B
   gpg: Good signature from "Debian CD signing key <[email protected]>" [unknown]
   gpg: WARNING: This key is not certified with a trusted signature!
   gpg:          There is no indication that the signature belongs to the owner.
   Primary key fingerprint: DF9B 9C49 EAA9 2984 3258  9D76 DA87 E80D 6294 BE9B
   

   This is not an error — it’s GPG doing its job. This warning exists to protect you from “key substitution” attacks — where an attacker replaces a legitimate key on the keyserver with their own. By forcing you to verify the fingerprint against an official source (like debian.org over HTTPS), GPG ensures you’re not trusting a malicious imposter — even if their signature is mathematically valid.

   Finally, check the key fingerprints:

   gpg --fingerprint 988021A964E6EA7D DA87E80D6294BE9B 42468F4009EA8AC3
   

   You should see output like:

   pub   rsa4096 2009-10-03 [SC]
         1046 0DAD 7616 5AD8 1FBC  0CE9 9880 21A9 64E6 EA7D
   uid           [ unknown] Debian CD signing key <[email protected]>
   
   pub   rsa4096 2011-01-05 [SC]
         DF9B 9C49 EAA9 2984 3258  9D76 DA87 E80D 6294 BE9B
   uid           [ unknown] Debian CD signing key <[email protected]>
   sub   rsa4096 2011-01-05 [E]
   
   pub   rsa4096 2014-04-15 [SC]
         F41D 3034 2F35 4669 5F65  C669 4246 8F40 09EA 8AC3
   uid           [ unknown] Debian Testing CDs Automatic Signing Key <[email protected]>
   sub   rsa4096 2014-04-15 [E]
   

   The [unknown] indicates the trust level of your local trust database. You can reference the Cryptography with GNU Privacy Guard to update this information.

   Cross-reference the fingerprints on:

   • Debian CD Verification Guide
   • Debian FTP Master Keys

   If you find a match then you’ve successfully cryptographically and visually confirmed the key’s authenticity. This is the gold standard of verification.