jaJGgXzD/QntiNiWH1iaB7NxeZJPzKGg8O7MPUvQV4Cn02uoE5J5EY8XZrGhNPVl
D4HHrQb+dMrwImEAGovHMdqVPJIiTGRFm5umwpKK8NRVWGjpsu8=
=fHjz
-----END PGP SIGNATURE-----


Source: qsb-118-2026.txt.sig.marmarek (https://github.com/QubesOS/qubes-secpack/blob/f65082c8211a421ed15a59219d6e54e93289fafb/QSBs/qsb-118-2026.txt.sig.marmarek)

Simon Gaiser (aka HW42) (https://www.qubes-os.org/team/#simon-gaiser-aka-hw42)’s PGP signature

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE6hjn8EDEHdrv6aoPSsGN4REuFJAFAmqSRk0ACgkQSsGN4REu
FJC8wQ//UOa2EdMZpIDLaYropqMHyt7cVlm3Ad4zpgqmteWOUSS2z6Y3DLA2b0Ng
xVDsmgJcoxqMt0tbzU9awSB/v41CKPQlXnevEFucwZWgeoQIhnZwr7c6zo2unngv
wc2eMMsIL/7QX2DPotoieshryTUB6kbb1hKwiXojWOJKTwVvQPRZmU6hWLAXtg7G
F4Ar/XMm2DR+KstIHFpvP+IWdS41+SWjIgjJJraUl5BE7mDF51M8vR4IvVM9Td8w
bb1ENAFO2W/ZnYnqGJpMmzWVhDzxjkikH9TT3CZmdulXa7ggK2V2EgBDJ681XtW+
jOC9f5OJjoVHc5LtPsAMZxL3sGbfOBfogK5Fwpi6lmzjcG3oCB6MMvEkveZRaSiO
H8vPl4H1dEIUKSA1LGZWEgY8RjuX0N4pnNOLzbn86tMpqYLtNBqGZ2/r8WkJSfXS
fYWyVAtF9kcy8scb4lYlsdfD7gZ8wH7dl/iUKikiS3NyFdAlYvb0OZd6c7BZwD2C
+YLHlo03he9WE1GbLoPPzqTN8VnunJ9eyyCs56SsHL5CYLfLnT95kMssAd+uJypo
7QZj3+xz7i2kaqK4osEL+5WUR47DyJEgKP8bMPeCV5ZZFC85eVKAn4BzYULx6tff
wVin+t9uZ2kwur7IyG+8Bb1PUgr+vATsVW1QcrfcRT6ujY4VDDs=
=1/K/
-----END PGP SIGNATURE-----


Source: qsb-118-2026.txt.sig.simon (https://github.com/QubesOS/qubes-secpack/blob/f65082c8211a421ed15a59219d6e54e93289fafb/QSBs/qsb-118-2026.txt.sig.simon)

What is the purpose of this announcement?

The purpose of this announcement is to inform the Qubes community that a new Qubes security bulletin (QSB) has been published.

What is a Qubes security bulletin (QSB)?

A Qubes security bulletin (QSB) (https://www.qubes-os.org/security/qsb/) is a security announcement issued by the Qubes security team (https://doc.qubes-os.org/en/latest/project-security/security.html#qubes-security-team). A QSB typically provides a summary and impact analysis of one or more recently-discovered software vulnerabilities, including details about patching to address them.

Why should I care about QSBs?

QSBs tell you what actions you must take in order to protect yourself from recently-discovered security vulnerabilities. In most cases, security vulnerabilities are addressed by updating normally (https://doc.qubes-os.org/en/latest/user/how-to-guides/how-to-update.html). However, in some cases, special user action is required. In all cases, the required actions are detailed in QSBs.

What are the PGP signatures that accompany QSBs?

A PGP (https://en.wikipedia.org/wiki/Pretty_Good_Privacy) signature is a cryptographic digital signature (https://en.wikipedia.org/wiki/Digital_signature) made in accordance with the OpenPGP (https://en.wikipedia.org/wiki/Pretty_Good_Privacy#OpenPGP) standard. PGP signatures can be cryptographically verified with programs like GNU Privacy Guard (GPG) (https://gnupg.org/). The Qubes security team cryptographically signs all QSBs so that Qubes users have a reliable way to check whether QSBs are genuine. The only way to be certain that a QSB is authentic is by verifying its PGP signatures.

Why should I care whether a QSB is authentic?

A forged QSB could deceive you into taking actions that adversely affect the security of your Qubes OS system, such as installing malware or making configuration changes that render your system vulnerable to attack. Falsified QSBs could sow fear, uncertainty, and doubt about the security of Qubes OS or the status of the Qubes OS Project.

How do I verify the PGP signatures on a QSB?

The following command-line instructions assume a Linux system with git and gpg installed. (For Windows and Mac options, see OpenPGP software (https://doc.qubes-os.org/en/latest/project-security/verifying-signatures.html#openpgp-software).)



Obtain the Qubes Master Signing Key (QMSK), e.g.:

$ gpg --fetch-keys https://keys.qubes-os.org/keys/qubes-master-signing-key.asc
gpg: directory '/home/user/.gnupg' created
gpg: keybox '/home/user/.gnupg/pubring.kbx' created