Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So we all know that Chef's remote_file resource has this problem: You can give it an attribute for a checksum, but it only uses that to determine if it should download the file again, not to verify a download.

I found a good blog post on writing a cookbook to actually verify the download against the checksum.

Now I want to apply this to nginx. They sign their tarballs with GPG, which is all well and good, but on my production servers I can't reach the gpg key server, nor do I want to.

I can certainly include the public key file and the signature file in my cookbook.

So given that I have the public key and the signature as .asc files, I could import the public key, then use gpg to verify the download signature. That means a .gnupg directory will be created in the home of whoever's running chef-client, and the public key will be imported into its keyring.

This isn't something that appeals to me on an automated basis! Yet I can't find any way to test the signature of the tarball without importing the public key and creating a keyring.

Should I stop worrying and just do it?

share|improve this question
This question is actually useful for the process, and may in fact be the right answer: serverfault.com/questions/528351/… –  Mojo Nov 20 '13 at 19:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.