Do .sig files contain information to check the integrity of files?

stf92 · 12-10-2015, 07:07 PM

I downloaded the following files.

Code:

total 2260
-rw------- 1 bill bill 1428776 Dec  8 22:31 avr-libc-1.8.0.tar.bz2
-rw------- 1 bill bill      72 Dec  8 22:32 avr-libc-1.8.0.tar.bz2.sig
-rw------- 1 bill bill  127217 Dec  8 22:33 avr-libc-manpages-1.8.0.tar.bz2
-rw------- 1 bill bill      72 Dec  8 22:33 avr-libc-manpages-1.8.0.tar.bz2.sig
-rw------- 1 bill bill  725852 Dec  8 22:33 avr-libc-user-manual-1.8.0.tar.bz2
-rw------- 1 bill bill      72 Dec  8 22:34 avr-libc-user-manual-1.8.0.tar.bz2.sig

There are no .md5 files here. Do .sig files contain information to check the integrity of files, besides checking authenticity? A related question would be: don't .bz2 files contain error detection code?

frankbell · 12-10-2015, 07:40 PM

Apparently they do include some means of integrity checking, though I've never used it. See this thread: http://www.linuxquestions.org/questi...g-file-259395/

GazL · 12-11-2015, 06:08 AM

Could also be an OpenBSD 'signify' signature file, which also uses a '.sig' filename suffix. Or, it could be anything else for that matter: what's in a filename?... But, most likely, it's a GPG unarmored detached signature.

xflow7 · 12-11-2015, 07:03 AM

I believe if it's a GPG signature, the short answer is yes.

You can use gpg --verify to confirm the validity of the signature and the integrity of the file.

More here:

https://www.gnupg.org/gph/en/manual/x135.html

mralk3 · 12-11-2015, 09:07 AM

Usually the project maintainer or lead developer will sign their source archives with a GPG key. Not only does this verify the file is not tampered with, it also verifies the origin of the file and who it was last edited by.

md5 and sha256 check sums only verify that a file has not been edited since that specific check sum was created. Which is why many open source projects provide a GPG signature as well as a md5 checksum. I've seen sha256sums used in place of md5sums in projects where integrity is of higher value.

It has been proven that data collisions are possible with the md5 algorithm, so many projects that require higher validity of their data use the sha256 algorithm instead.