Hello, I have two problems:
I read in the
trezor.io website this : You should only trust downloads from our official website or GitHub page:
2. Official website:* https://trezor.io/trezor-suite
3. GitHub:* But the trezor suite installer is downloaded from: https://github.com/trezor/trezor-suite/releases https://objects.githubusercontent.com/ I should be absolutely sure I am downloading from the correct site and this does not looks ok. Also I can not verify the download: "the signature of this message is valid but untrusted” Thanks for your help.
If you only need the latest publicly released version, download the desktop version from
https://trezor.io/trezor-suite or use the web version at https://suite.trezor.io/web/.
Also I can not verify the download: "the signature of this message is valid but untrusted” Thanks for your help.
That’s a GPG thing. What it’s saying is:
You gave me a public key…
That public key
does match the download. So whoever owns that public key actually did sign the package.
However, I don’t know where you found the public key in the first place
By default, I don’t trust it unless you explicitly tell me to.
Check that the key fingeprint matches. If yes, that’s your confirmation that this is OK.
I have the same problem as
@Bitcoiner65 mentioned at 2.nd point.
The “Trezor-Suite-23.4.2-win-x64.exe.asc” file shows that the Trezor-Suite-23.4.2-win-x64.exe was not manipulated, but the signature (public key) from the creator (Trezor) is missing.
Could You(Trezor support) upload the public key on the
To check that the “satoshilabs-2021-signing-key.asc” was created from Trezor.