PGP signatures.

stf92 · 08-08-2010, 09:54 PM

Hi:

I have a file MPlayer.tar.gz (a slackbuild) and it came along with MPlayer.tar.gz.asc, whose contents is this:

Code:

root@darkstar:/big/store1/soft/mplayer/mplayerhq# cat MPlayer.tar.gz.asc
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.7 (GNU/Linux)

iD8DBQBH3qifA2jvV5x7o7YRAp2rAJ0fQMB8wgePyGNqaBZqx1l3EpzMywCeIScD
sDj2Sn+F8aSxaqy4GPGHRD8=
=RMWi
-----END PGP SIGNATURE-----
root@darkstar:/big/store1/soft/mplayer/mplayerhq#

Code:

root@darkstar:/big/store1/soft/mplayer/mplayerhq# gpgv MPlayer.tar.gz.asc
gpgv: keyblock resource `/root/.gnupg/trustedkeys.gpg': general error
gpgv: Signature made Mon 17 Mar 2008 02:21:35 PM ART using DSA key ID 9C7BA3B6
gpgv: Can't check signature: public key not found

You see what I did. But it is evident I'm doing something wrong (I'd say, all wrong). What do I do with the .asc? Thanks in advance.

EDIT: in another post I saw somebody using gpg. I tried but it failed too.
__________________
I would be much obliged to you if you point out my mistakes in English.
La

saivinoba · 08-08-2010, 10:29 PM

Hi stf92,
You should first have the public key of the packager. Supposing you are using slackbuilds.org, here is the link http://slackbuilds.org/GPG-KEY. Once you have the public key, be in the directory which has both tar.gz and the tar.gz.asc files and run

Code:

gpg --verify MPlayer.tar.gz.asc

If I'm not wrong, 'gpgv' is wrong

I referred this: http://slackbuilds.org/faq/#asc

stf92 · 08-08-2010, 10:37 PM

Hi:

Thanks. I already downloaded GPG-KEY from slackbuilds. I put it in the directory with the .gz and the .gz.asc but still 'gpg --verify MPlayer.tar.gz.asc' gives error. Regards.

bgeddy · 08-08-2010, 10:40 PM

Try this first

Code:

gpg --fetch-keys  http://slackbuilds.org/GPG-KEY

and then

Code:

gpg --verify MPlayer.tar.gz.asc

stf92 · 08-08-2010, 10:50 PM

I did it:

Code:

root@darkstar:/home/semoi/Desktop# gpg --verify MPlayer.tar.gz.asc
gpg: Signature made Mon 17 Mar 2008 02:21:35 PM ART using DSA key ID 9C7BA3B6
gpg: Good signature from "SlackBuilds.org Development Team <slackbuilds-devel@slackbuilds.org>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: D307 6BC3 E783 EE74 7F09  B8B7 0368 EF57 9C7B A3B6
root@darkstar:/home/semoi/Desktop#

Although I expected a more satisfying message or no message at all. Well, but I think I can now trust the transmited file MPlayer.tar.gz. Thank you very much.

Lufbery · 08-09-2010, 07:12 AM

Quote:

Originally Posted by stf92

I did it:

Although I expected a more satisfying message or no message at all.

If you want a more satisfying message, you need to generate your own public/private GPG key and then sign the Slackbuilds.org public key with your own private key.

This command:

Code:

gpg --gen-key

will get you started.

Check out the GPG mini-how-to for a great introduction. It's what I rely on when I'm working my way through GPG.

Also, KDE's KGPG utility is a great graphical front end for GPG.

Regards,

stf92 · 08-09-2010, 11:34 AM

It's been very kind of you. Thank you very much.

Lufbery · 08-09-2010, 11:41 AM

Quote:

Originally Posted by stf92

It's been very kind of you. Thank you very much.

You're welcome. By the way, here's the same file in Spanish.

Regards,