verification fails for OPNsense-26.7-vga-amd64.img.bz2 despite matching checksum

[tj0219]

Hi everyone, I have tried walking through this a few times and I'm stuck. In fairness I'm a beginner and its not looking good. lol

I cant get the published .sig file for the 26.7 vga-amd64 image to verify against the published .img.bz2 and .pub files, using the exact verification process documented at docs.opnsense.org/manual/install.html.

I have tried downloading fresh files from multiple mirrors, as well as on two different systems.


these are the files i have grabbed:
OPNsense-26.7-vga-amd64.img.bz2
OPNsense-26.7-vga-amd64.img.sig
OPNsense-26.7.pub
OPNsense-26.7-checksums-amd64.sha256

i downloaded the newest version of SSL:
OpenSSL 4.0.2 25 Aug 2026


just get this

Verification failure
64250000:error:0308010C:digital envelope routines:inner_evp_generic_fetch:unsupported:crypto\evp\evp_fetch.c:376:Global default library context, Algorithm (dgst : 0), Properties (<null>)
64250000:error:02000068:rsa routines:ossl_rsa_verify:bad signature:crypto\rsa\rsa_sign.c:441:
64250000:error:1C880004:Provider routines:rsa_verify_directly:RSA lib:providers\implementations\signature\rsa_sig.c:1071:

Any help or ideas on what to try would be appreciated.

Thanks!

[patient0]

Please post the exact commands you run (up to the one that failed), one by one. And include what operation system you used.

[franco]

The signature is for the uncompressed image. The checksum is for the compressed image.


Cheers,
Franco