3

I was following this instruction to install VirtualBox on my Ubuntu 20.04 LTS machine.

As per instruction I registered the public key:

wget -O- https://www.virtualbox.org/download/oracle_vbox_2016.asc | sudo gpg --dearmor --yes --output /usr/share/keyrings/oracle-virtualbox-2016.gpg

They state that the fingerprint for oracle_vbox_2016.asc is

B9F8 D658 297A F3EF C18D  5CDF A2F6 83C5 2980 AECF
Oracle Corporation (VirtualBox archive signing key) <[email protected]>

Now, I am trying to verify the fingerprint but I have trouble extracting the fingerprint from the .gpg file.

For example, if I use the following command, it outputs some information but not the fingerprint:

gpg --with-fingerprint /usr/share/keyrings/oracle-virtualbox-2016.gpg

What command do I have to use to extract the fingerprint from the oracle-virtualbox-2016.gpg file?

Improve this question
2
  • You should not need a fingerprint to install VBOX on Linux or Windows. Lots of computers do not have fingerprints. Try again without using fingerprints.
    – John
    Oct 16, 2022 at 0:58
  • 1
    @John Yes, it is not necessary for installation. However, I wanted to test and see whether the fingerprint of the registered key matches the one they stated in their installation instruction. So, it was more out of curiosity but I guess, it is also a way to authenticate the public key.
    – Tando
    Oct 16, 2022 at 11:35

2 Answers 2

Reset to default
2

Welcome Tando to Superuser,

You can check the fingerprint of the pubic key in the keyring with the following command:

gpg --no-default-keyring --keyring /usr/share/keyrings/oracle-virtualbox-2016.gpg --fingerprint
Improve this answer
1
  • 2
    Thank you! I've also just found another command that works with gpg 2.2.19: gpg --show-keys --with-fingerprint /usr/share/keyrings/oracle-virtualbox-2016.gpg. The --with-fingerprint flag is not necessary but it makes the fingerprint better readable by dividing it in groups of 4 characters.
    – Tando
    Oct 16, 2022 at 11:36
0

Using gpg version 2.2.27

gpg --version

# output
gpg (GnuPG) 2.2.27
libgcrypt 1.9.4

Download the current .asc file from https://www.virtualbox.org/wiki/Linux_Downloads as of this writing (2023-03-22):

wget https://www.virtualbox.org/download/oracle_vbox_2016.asc

The VirtualBox website currently states:

The key fingerprint for oracle_vbox_2016.asc is

B9F8 D658 297A F3EF C18D  5CDF A2F6 83C5 2980 AECF
Oracle Corporation (VirtualBox archive signing key) <[email protected]>

The following commands all allow to verify this information, each with different formatting:

gpg --show-keys --with-fingerprint --keyid-format=short oracle_vbox_2016.asc

Output:

pub   rsa4096/2980AECF 2016-04-22 [SC]
      Key fingerprint = B9F8 D658 297A F3EF C18D  5CDF A2F6 83C5 2980 AECF
uid                    Oracle Corporation (VirtualBox archive signing key) <[email protected]>
sub   rsa4096/920E471F 2016-04-22 [E]

gpg --show-keys --with-fingerprint oracle_vbox_2016.asc

Output:

pub   rsa4096 2016-04-22 [SC]
      B9F8 D658 297A F3EF C18D  5CDF A2F6 83C5 2980 AECF
uid                      Oracle Corporation (VirtualBox archive signing key) <[email protected]>
sub   rsa4096 2016-04-22 [E]

gpg --show-keys oracle_vbox_2016.asc

Output:

pub   rsa4096 2016-04-22 [SC]
      B9F8D658297AF3EFC18D5CDFA2F683C52980AECF
uid                      Oracle Corporation (VirtualBox archive signing key) <[email protected]>
sub   rsa4096 2016-04-22 [E]

gpg --show-keys --with-colons oracle_vbox_2016.asc

Output ("The --with-colons option emits the output in a stable, machine-parseable format, which is intended for use by scripts and other programs."):

pub:-:4096:1:A2F683C52980AECF:1461318881:::-:::scESC::::::23::0:
fpr:::::::::B9F8D658297AF3EFC18D5CDFA2F683C52980AECF:
uid:-::::1461318881::CA5D570DDFDB695A0301885765DD8E285368742C::Oracle Corporation (VirtualBox archive signing key) <[email protected]>::::::::::0:
sub:-:4096:1:AD18C79D920E471F:1461318881::::::e::::::23:
fpr:::::::::31DD01EB8C64DF3D12E7BC97AD18C79D920E471F:
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .