1

I've got a script to fetch Gcrypt's five source packaes from GnuPG Download. I also fetch the signature for each package. For example:

FILE=libassuan-2.2.0
wget -q "ftp://ftp.gnupg.org/gcrypt/libassuan/$FILE.tar.bz2.sig" -O "$FILE.tar.bz2.sig"
wget -q "ftp://ftp.gnupg.org/gcrypt/libassuan/$FILE.tar.bz2" -O "$FILE.tar.bz2"
gpg --verify "$FILE.tar.bz2.sig" "$FILE.tar.bz2"

While trying to verify the download, I get an error "Can't check signature: public key not found". This is expected since the VM is fairly clean and it does not have a GPG keychain (I think that's what its called).

I have the public key block from the Signature Key page, and its in a file called gpg-signers.pem. But I don't know how to use it with GPG.

I've searched the man pages, but I don't see how to pass public key block (gpg-signers.pem) to the command (gpg --verify). There is a --sign-key, but its used to "sign a public key with you secret key"; and not specify the signer's key to verify a signature.

How do I pass gpg-signers.pem to gpg --verify to verify the signature on the package?

1 Answer 1

2

We have to import the keys before checking the signature.

$ gpg --import gpg-signers.pem
gpg: key 4F25E3B6: public key "Werner Koch (dist sig)" imported
$ gpg --verify libassuan-2.2.0.tar.bz2.sig libassuan-2.2.0.tar.bz2
gpg: Signature made Thu 11 Dec 2014 21:13:07 JST using RSA key ID 4F25E3B6
gpg: Good signature from "Werner Koch (dist sig)"

If we don't want the keys to be stored in the local database permanently, use a disposable keyring.

$ gpg --no-default-keyring --keyring 1.keyring --import gpg-signers.pem
gpg: keyring 1.keyring created
...
$ gpg --no-default-keyring --keyring 1.keyring --verify ...
...
$ trash 1.keyring

By design, we receive keys out-of-band.

Though not as convenient as HTTPS, we can download Werner Koch's public key by gpg --recv-key 4F25E3B6. This command work out-of-box on many distros with a preconfigured keyserver. It is easy to write some script look into a signature file and automatically download the key the person who issue this signature used. But the decision is still left upon us, to determine whether to trust or not trust the person.

4
  • 1
    Is it any wonder that security like GPG is not widely adopted.... Its pretty sad when you can't even verify a signature with a message and a key without embarking on 5 extra steps, a search of the man pages and help from Super User...
    – jww
    Mar 3, 2015 at 5:19
  • edited, maybe the new section is good for your additional comment. Mar 3, 2015 at 6:01
  • 3
    "By design, we add only keys from people we trust" is quite nonsense. You only sign keys from people you trust. Merely adding them to the keyring changes absolutely nothing. Mar 3, 2015 at 6:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .