How to make use of MD5SUMS.sign file on Debian ISO downloads

kushalkoolwal · 02-19-2009, 01:54 PM

Hi,

I know how to use the MD5SUMS file to verify the integrity of ISO download. However I am not sure how to use the MD5SUMS.sign files that accompanies the MD5SUMS file.

Here is a good example: http://cdimage.debian.org/debian-cd/5.0.0/i386/iso-cd/

armandrix · 02-19-2009, 02:12 PM

Hi,

Md5sum hash files contains an byte-a-byte generated number, where you can check if at least 1 byte is changed. Useful to detect download errors or any modification on the original file.. if the numbers match file is identical.

md5.sign you are referred, is also a check for the digital sign of the publisher, wich is an file too and is important that it is unchanged.

You can read more about it here http://www.gnupg.org/

cheers

kushalkoolwal · 02-19-2009, 02:15 PM

Quote:

Originally Posted by armandrix

md5.sign you are referred, is also a check for the digital sign of the publisher, wich is an file too and is important that it is unchanged.

Thanks for your time. However my question was how do I use that ".sign" file?

armandrix · 02-19-2009, 02:43 PM

Hi..

You use this when installing stuffs from many package managers, also you can use "gpg --verify", here a little fromman page:

Quote:

--verify
Assume that the first argument is a signed file or a detached signature and verify it without generating any
output. With no arguments, the signature packet is read from stdin. If only a sigfile is given, it may be a
complete signature or a detached signature, in which case the signed stuff is expected in a file without the
".sig" or ".asc" extension. With more than 1 argument, the first should be a detached signature and the
remaining files are the signed stuff. To read the signed stuff from stdin, use '-'’ as the second filename.
For security reasons a detached signature cannot read the signed material from stdin without denoting it in
the above way.

Hope it helps

kushalkoolwal · 02-19-2009, 08:34 PM

Quote:

Originally Posted by armandrix

Hi..

You use this when installing stuffs from many package managers, also you can use "gpg --verify", here a little fromman page:

Hope it helps

Ok here is what I did:

Code:

debian:/mnt/temp# gpg --verify MD5SUMS.sign 
gpg: Signature made Sat 14 Feb 2009 11:51:23 PM PST using DSA key ID 88C7C1F7
gpg: Can't check signature: public key not found
debian:/mnt/temp#

Not sure what is happening here. I understand that the sign file MD5SUMS.sign file exits so that we can verify that the file MD5SUM was being generated by the person who actually did generate it. Not sure what step am I missing?

kushalkoolwal · 02-19-2009, 09:05 PM

Ok, I think I got it now!

Thank you.

nx5000 · 02-20-2009, 05:24 AM

Probably the public key is in the package debian-archive-keyring which looks like installed by default. So it has worked?