4

As an example, this project offers an *.asc file with a PGP signature to verify the contents of the download (as opposed to a checksum, you can see the empty column): https://ossec.github.io/downloads.html

How would I use this file? I tried gpg --verify and other variants, but it seems to be matching the name up to the file, however the filename as it is downloaded is not exactly the same... not sure how it is supposed to work.

6
  • Download the key file:
wget https://ossec.github.io/files/OSSEC-ARCHIVE-KEY.asc
  • Inspect the key file to confirm it has EE1B0E6B2D8387B7 as its keyid.
gpg --keyid-format long --show-key OSSEC-ARCHIVE-KEY.asc
  • If correct, then import the key:
gpg --import OSSEC-ARCHIVE-KEY.asc
  • Download the software package
wget https://github.com/ossec/ossec-hids/archive/2.9.3.tar.gz
  • Download the signature file
https://github.com/ossec/ossec-hids/releases/download/2.9.3/ossec-hids-2.9.3.tar.gz.asc
  • Verify it
gpg --verify ossec-hids-2.9.3.tar.gz.asc 2.9.3.tar.gz

Output

gpg: Signature made Sat Dec 23 16:13:01 2017 UTC
gpg:                using RSA key EE1B0E6B2D8387B7
gpg: Good signature from "Scott R. Shinn <scott@atomicorp.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: B50F B194 7A0A E311 45D0  5FAD EE1B 0E6B 2D83 87B7
  • It seems that the --verify option expects the signature file – niahoo Feb 2 at 15:17
  • I get gpg: WARNING: "--show-keyring" is a deprecated option gpg: please use "--list-options show-keyring" instead – Dan Dascalescu May 13 at 4:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.