I am a new user of GnuPG. I am very much familiar with concept of public and private keys, as well as Web of Trust after reading The GNU Privacy Handbook and a couple of blogs. Still, I don't how I should proceed if I have just started with an empty keyring and trustdb, and need to check new files downloaded from internet.
For instance, I would like to compile Emacs from sources. I downloaded two files from its website Gnu Emacs:
emacs-25.3.tar.gz. I checked signature and have got this output:
gpg: Signature made Mon 11 Sep 2017 20:52:45 BST gpg: using RSA key 28D3BED851FDF3AB57FEF93C233587A47C207910 gpg: Can't check signature: No public key
For some reason, I cannot retrieve the key "7C207910" as gpg states:
[fw@localhost~ ]$ gpg --recv-keys 7C207910 gpg: Note: signatures using the SHA1 algorithm are rejected gpg: key 0x233587A47C207910: 19 signatures not checked due to missing keys gpg: key 0x233587A47C207910: 10 bad signatures gpg: key 0x233587A47C207910: no valid user IDs gpg: this may be caused by a missing self-signature gpg: Total number processed: 1 gpg: w/o user IDs: 1
After verification, it looks to me that the key belons to Nicolas Petton, whose key ID ends with
7C207910. I guess if I received the key from keyserver, I would know its fingerprint. If both fingerprints matched, on the website and in my newly received key, would that be enough to confirm the key belogs to Nicolas Petton? Would it be enough information to confirm the key and set its trust to full?
What is your routine?