Hi all,

I have .sig signature file, want to check it.
<code> gpg -–verify filename.sig </code>
Output was “No valid open PGP data found. The signature could not be verified”.

Q1. I suppose I have to request emitter of the file to send his public key ?

Q2. What should I do precisely when I'll get the key, to actually store it in what I suppose to be the "keyring" ?

Q3. The files and signature will arrive automatically in my system, how can the process be automated server-side so ?

Regards,

if you have the public key already, try switching your command around:

gpg --verify sigfile.sign filename


and to import a key, try:

gpg --recv-keys ABCD1234

replacing the 8-characters with the first 8 characters of the key you want to import. The key will get stored *somewhere* but I'm not sure where right off; if you have the GUI tool PGP or GPG or whatever it's called, you can use that to view or import/export keys too.

I'm not sure how to address Q3 -- can you clarify that question?

Sasha

PS - for your <code> tags, use [square brackets]