How do you GPG verify all of your rsync slackware directory
 

hi all,

just wondering how I might go about doing a gpg verify on an entire rsync download directory of slackware 10.2

thank you in advance.

If anyone does know the answer for this then great, however, effectively my answer is taken care of by the ability to this recommendation to use DVD download at

http://www.linuxquestions.org/questi...d.php?t=464588

Just check CHECKSUMS.md5 using gpg. After that you can just check the md5sums of all the files. To do that:
Edit: grammar

drumz,

your going to kill me :D but I'm still kind of confused, i'm sorry.

is that a two step process?

I see slackware's GPG-KEY so I believe I just import that.

edit: I should use the GPG-KEY off Pat's web-site :D

then gpg --verify CHECKSUMS.md5.asc CHECKSUMS.md5

then do I do what you listed in your code section? that recurses (dives down) thru all the sub-folders and files?

thank you for dealing with me :D

You can take two approaches:

(1) verify the integrity of the file containing the md5 checksums and then verify the correctness of those checksums against the downloaded files (drumz' approach):

The other approach is to individually verify the gpg signature of every package you downloaded:

The "grep -v" filters out the output for the non-compromised packages so that you will only see output for packages that are tampered with. You can leave that out so that last command becomes
You will have to download and import the Slackware GPG-KEY from the Slackware server (preferably not a mirror).

Cheers, Eric

Old_Fogie: correct.

The checksum method will verify everyfile, while the gpg method will only check packages. The worst that could happen in the second case is you'll get a corrupt *.txt file that describes a package. That's why I prefer the checksum method. Also, I don't know enough bash to whip out that "find" statement. :)

Hey it's Eric! where have you been, I was about to send the dog's out to go find you :D

Wow guys, that works awesome. Running it all right now. So far so good.

Only issues on md5sum side is a bunch of errors pertaining to 'pasture':

md5sum: ./pasture/source/pop3d-1.020i/pop3d-1.020i.tar.gz: No such file or directory

which makes perfect sense as Eric's script by default 'omits' the pasture stuff.

This is going in the notebook for sure.

Slightly off topic, but is there a way to increase the size of, for lack of better term at the moment, the 'buffer' of Konsole in KDE?

When I ran "md5sum -c CHECKSUMS.md5" you only get so far in KDE. Now drumz had the konsole report errors which was great. Two ways to skin a cat.

But I've noticed when running '.configure'...etc etc on programs like net-snmp there is info echoed on the screen and there is no way to get back to it; and doing this here reminded me of that slight obstacle.

Anyone thoughts? Thanks again so much BTW.

I've been away, enjoying a couple of holiday weeks in France :-)

Try to read back the console buffer by using <SHIFT><PageUp>, or write the output text to a logfile like this;

At the end, the file "output.log" will contain all the text you've seen passing your screen.

Eric

Hi All,

Hey Eric thank you, that log output is really good for me to trouble shoot a different issue I have with madwifi :D not that I'm trying to drag you into it or anything like that LOL , nudge nudge located here

http://www.linuxquestions.org/questi...91#post2339891

hahaha, but thank you that really helps as I was able to do that at CLI on my slow laptop, and the X on my laptop has small buffer.

thanks agin.

fogie.

Alien Bob, does the command above "dive into subdirectories"? or only go into the top level. This command finishes on an entire rsync of slack 10.2 in under 2 seconds, does that sound right?

Thank you.

That does not sound right. The command should process all of the directory tree below, and should take several minutes.

Try breaking the command into pieces:

See what it finds:
See what gpg thinks of those:
Eric

TY eric,

I made some headway..

I actually was in the /slackware-10.2 directory when trying...and failing.

Performing the command one level up above the folder that has all of the slackware downloaded stuff works.

Two things:

1) for some reason the grep seems to only remove that line that says "good sig..." but the rest of each files gpg info is still shown on screen.
2) I'm getting a lot of bad signatures! Checksum verify way works, but bad sig's? Is there a way for the console to tell you which file is bad?

An example of a file with a bad signature (and the gpg output)?

Eric

could something be wrong with my gpg?

I'm also trying to verify a download of 'snort' and I get this too:

I downloaded those, but a 3MB file is probably not a valid gpg signature file... my guess is they screwed up.
I got the same error you had.

Eric