5

From my limited knowledge of PGP/GPG, one must have 2 things to verify a file:

  • The file's "signature" (essentially a hash of the file encrypted with the trusted entity's private key; normally distributed as a .sig binary or .asc base64 file).

  • The trusted entity's public key.

And it seems to be inline with the examples I looked at using gpg. However, I'm a bit confused as I try to verify a file downloaded from one of GCC's mirror sites. On the mirror site listing page (http://gcc.gnu.org/mirrors.html), it says:

The archives (hosted on these mirrors) will be signed by one of the following GnuPG keys:

And then it lists 6 possible keys:

1024D/745C015A 1999-11-09 Gerald Pfeifer <[email protected]>
Key fingerprint = B215 C163 3BCA 0477 615F 1B35 A5B3 A004 745C 015A

1024D/B75C61B8 2003-04-10 Mark Mitchell <[email protected]>
Key fingerprint = B3C4 2148 A44E 6983 B3E4 CC07 93FA 9B1A B75C 61B8

1024D/902C9419 2004-12-06 Gabriel Dos Reis <[email protected]>
Key fingerprint = 90AA 4704 69D3 965A 87A5 DCB4 94D0 3953 902C 9419

1024D/F71EDF1C 2000-02-13 Joseph Samuel Myers <[email protected]>
Key fingerprint = 80F9 8B2E 0DAB 6C82 81BD F541 A7C8 C3B2 F71E DF1C

2048R/FC26A641 2005-09-13 Richard Guenther <[email protected]>
Key fingerprint = 7F74 F97C 1034 68EE 5D75 0B58 3AB0 0996 FC26 A641

1024D/C3C45C06 2004-04-21 Jakub Jelinek <[email protected]>
Key fingerprint = 33C2 35A3 4C46 AA3F FB29 3709 A328 C3A2 C3C4 5C06 

All it provides are those key id's and fingerprints (not the actual keys themselves), and nowhere on the page (or on any of the mirrors, or even within the 4.8.0 tarball) is a .sig/.asc signature file.

My question: How am I supposed to verify this tarball (http://gcc.petsads.us/releases/gcc-4.8.0/gcc-4.8.0.tar.gz) without a signature file, and without knowing the public key, or without knowing which of the 6 keys may have been used to sign the file? Can someone with more knowledge of GPG please explain the simplest way to verify this file?

2 Answers 2

9

Received an explanation from the GNU/GCC team about this, and the .sig files were missing due to an error with file replication to their mirror servers. From the team:

Interestingly, the .sig files are only on the GNU server (e.g., http://ftp.gnu.org/gnu/gcc/gcc-4.8.0/) but not on the GCC server (e.g., ftp://gcc.gnu.org/pub/gcc/releases/gcc-4.8.0/). As the latter is used by the mirrors, it is also not available on the mirrors.

I found the .sig files on the GNU server like they suggested, but then had to dig some more to find the "GNU keyring file" required to actually verify the signature. All in all, the verification process was:

$ wget http://www.netgull.com/gcc/releases/gcc-4.8.0/gcc-4.8.0.tar.gz
$ wget http://ftp.gnu.org/gnu/gcc/gcc-4.8.0/gcc-4.8.0.tar.gz.sig
$ wget ftp://ftp.gnu.org/gnu/gnu-keyring.gpg
$ gpg --verify --keyring ./gnu-keyring.gpg ./gcc-4.8.0.tar.gz.sig

gpg: Signature made Fri 22 Mar 2013 08:32:29 AM CDT using DSA key ID C3C45C06
gpg: Good signature from "Jakub Jelinek <[email protected]>"
gpg: Note: This key has expired!
Primary key fingerprint: 33C2 35A3 4C46 AA3F FB29  3709 A328 C3A2 C3C4 5C06

Hopefully this helps anyone else trying to verify a tarball downloaded from one of GCC's mirror sites.

1
  • 2
    You should consider using HTTPS for these wget commands Jun 30, 2015 at 21:09
4

You need the sig file. The only other way is if the file itself were a ".gpg" and had an attached signature. If the message says "they will be signed" and the mirror does not have the .sig, the .sigs have been removed from the mirror.

You can verify the signatures with any of the other mirrors, just get the .sig from one of them -- unless the .gz was modified, the signature will still apply.

1
  • I've checked about 10 of the mirrors, and none of them have a .sig or .asc file, like I expected. The package itself does not contain such a file, either. You can have a look for yourself at: gcc.gnu.org/mirrors.html
    – etherice
    Apr 29, 2013 at 19:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .