FJC79hAAkhqOJVm1BKgw/zE+uKgMYL6ZvOPOae7wO14uL7yimqWCWZEURmsdI69d
aqj7H2F34vjcFbVo6ZvBvjzGZ4RBt26URAvoqPeVNvQc7e/8/bd98hPHSoxpvtke
5nV1vhKwl9hm6xaBW3noEbxcV7vBkf3SKCJ2qHB/anLGB72ykMS03aZ+lwsHEhl+
ErCf6komlqXakhPCNYBqhWE1Thi2ggGvaREOiIgvt2nrKi3NlJ/QC39D5/NAorZb
jvsDcpEFHXtKre13zdG/wnTp3zM0Cx+XWatlNhgddLLgUk1dwtJ+gMuOiVqAIluh
pPc0fiYIcs1ZTuSGRg5yC0j604nAwbKeAbQYcY/i/Ya5OTjmjcOMisxpciVdflo2
QwHD/c7ydxIdFGziz4BwQKPTuBPkKD6QxaSlsrkOoIZqT6PLCf+maX24YcY7Wt7a
KOYlCrr59ePSlyFaaI2vuG2wf2PRYFi0ra5NeQwiB8Wb+xDu224hYZMW4RhnHvzL
azbpiF7A2E0RgeUiAshXhIsPACXxOXD+1K59DxnswYaf7RaHWrdLhZDA27R6H6fv
qHV9TRciInBuiV6nvdW4LGo8iPgr7eNBOq7MK5j8Wz2XhjjSfq4LbJPlmTbwbDVg
5EEM18GT6L08RxK0xvAUuaVaANc1Eay89WLBMjepB28uDpLuA5Y=
=Ufwb
-----END PGP SIGNATURE-----


Source: qsb-120-2026.txt.sig.simon (https://github.com/QubesOS/qubes-secpack/blob/4ea6603c1eb68df12868bf4c97d8efefa8d15799/QSBs/qsb-120-2026.txt.sig.simon)

What is the purpose of this announcement?

The purpose of this announcement is to inform the Qubes community that a new Qubes security bulletin (QSB) has been published.

What is a Qubes security bulletin (QSB)?

A Qubes security bulletin (QSB) (https://www.qubes-os.org/security/qsb/) is a security announcement issued by the Qubes security team (https://doc.qubes-os.org/en/latest/project-security/security.html#qubes-security-team). A QSB typically provides a summary and impact analysis of one or more recently-discovered software vulnerabilities, including details about patching to address them.

Why should I care about QSBs?

QSBs tell you what actions you must take in order to protect yourself from recently-discovered security vulnerabilities. In most cases, security vulnerabilities are addressed by updating normally (https://doc.qubes-os.org/en/latest/user/how-to-guides/how-to-update.html). However, in some cases, special user action is required. In all cases, the required actions are detailed in QSBs.

What are the PGP signatures that accompany QSBs?

A PGP (https://en.wikipedia.org/wiki/Pretty_Good_Privacy) signature is a cryptographic digital signature (https://en.wikipedia.org/wiki/Digital_signature) made in accordance with the OpenPGP (https://en.wikipedia.org/wiki/Pretty_Good_Privacy#OpenPGP) standard. PGP signatures can be cryptographically verified with programs like GNU Privacy Guard (GPG) (https://gnupg.org/). The Qubes security team cryptographically signs all QSBs so that Qubes users have a reliable way to check whether QSBs are genuine. The only way to be certain that a QSB is authentic is by verifying its PGP signatures.

Why should I care whether a QSB is authentic?

A forged QSB could deceive you into taking actions that adversely affect the security of your Qubes OS system, such as installing malware or making configuration changes that render your system vulnerable to attack. Falsified QSBs could sow fear, uncertainty, and doubt about the security of Qubes OS or the status of the Qubes OS Project.

How do I verify the PGP signatures on a QSB?

The following command-line instructions assume a Linux system with git and gpg installed. (For Windows and Mac options, see OpenPGP software (https://doc.qubes-os.org/en/latest/project-security/verifying-signatures.html#openpgp-software).)



Obtain the Qubes Master Signing Key (QMSK), e.g.:

$ gpg --fetch-keys https://keys.qubes-os.org/keys/qubes-master-signing-key.asc
gpg: directory '/home/user/.gnupg' created
gpg: keybox '/home/user/.gnupg/pubring.kbx' created
gpg: requesting key from 'https://keys.qubes-os.org/keys/qubes-master-signing-key.asc'
gpg: /home/user/.gnupg/trustdb.gpg: trustdb created
gpg: key DDFA1A3E36879494: public key "Qubes Master Signing Key" imported
gpg: Total number processed: 1
gpg: imported: 1