How to verify downloaded file with .sig file?

Question

When I download GCC, it also has a .sig file, and I think it is provided to verify downloaded file. (I downloaded GCC from here).

But I can't figure out how should I use it. I tried gpg, but it complains about public key.

[root@localhost src]# gpg --verify gcc-4.7.2.tar.gz.sig gcc-4.7.2.tar.gz
gpg: Signature made Thu 20 Sep 2012 07:30:44 PM KST using DSA key ID C3C45C06
gpg: Can't check signature: No public key
[root@localhost src]# 

How can I verify downloaded file with .sig file?

Oro

Answer 1

You need to import public key: C3C45C06

Can be done in three steps.

1. find public key ID:

   $ gpg gcc-4.7.2.tar.gz.sig 
   gpg: Signature made Čt 20. září 2012, 12:30:44 CEST using DSA key ID C3C45C06
   gpg: Can't check signature: No public key
   

2. import the public key from key server. It's usually not needed to choose key server, but it can be done with --keyserver <server>. Keyserver examples.

   $ gpg --recv-key C3C45C06
   gpg: requesting key C3C45C06 from hkp server keys.gnupg.net
   gpg: key C3C45C06: public key "Jakub Jelinek <[email protected]>" imported
   gpg: no ultimately trusted keys found
   gpg: Total number processed: 1
   gpg:               imported: 1
   

If the command error's out with a timeout, you may be behind a firewall that is blocking the default gpg port. Try using the `--keyserver' option with port 80 (almost all firewalls allow port 80 b/c of web browsing):

$ gpg --keyserver hkp://${HOSTNAME}:80 --recv-keys ${KEY_ID}

3. verify signature:

   $ gpg gcc-4.7.2.tar.gz.sig 
   gpg: Signature made Čt 20. září 2012, 12:30:44 CEST using DSA key ID C3C45C06
   gpg: Good signature from "Jakub Jelinek <[email protected]>" [unknown]
   gpg: WARNING: This key is not certified with a trusted signature!
   gpg:          There is no indication that the signature belongs to the owner.
   Primary key fingerprint: 33C2 35A3 4C46 AA3F FB29  3709 A328 C3A2 C3C4 5C06
   

The output should say "Good signature".

---

gpg: WARNING: This key is not certified with a trusted signature!

Is for another question ;)

Juanajuanita

In the case that the file requiring verification is gnupg (not in the question), SHA-1 check-sums are available on the gnupg site for verifying ones first gnupg download. – Elena

During signature verification, gpg processes the tarball file and its corresponding .sig file as a unit. If the tarball is missing or renamed, gpg provides the opportunity to specify the tarball name. – Endocrinotherapy

I have get an RSA key, and doesn't to work without or with --keyserver from that list, only one get it but it seems not trusted, its weird since I'm trying it on GNU coreutils that is a widely used package. – Cornela

also, if gpg warns "no command supplied, guessing what you mean", use gpg --verify gcc-4.7.2.tar.gz.sig instead. – Oruro

So, I presume this is better than just a hash of the file - but I'm not sure how - given that "There is no indication that the signature belongs to the owner." – Southernly

Answer 2

This other avenue is particularly useful for verifying GNU projects (e.g. Octave) since the key requested by their signature may not be found in any key server.

From https://ftp.gnu.org/README

There are also .sig files, which contain detached GPG signatures of the above files, automatically signed by the same script that generates them.

You can verify the signatures for gnu project files with the keyring file from:

https://ftp.gnu.org/gnu/gnu-keyring.gpg

In a directory with the keyring file, the source file to verify and the signature file, the command to use is:

$ gpg --verify --keyring ./gnu-keyring.gpg foo.tar.xz.sig

Wunder

But if we are talking about security then it is better to use HTTPS connection: https://ftp.gnu.org/gnu/gnu-keyring.gpg – Mechanotherapy

Funny, I'm here explicitly to figure how to validate Octave! :) – Murton

Thanks. I couldn't find the Bash maintainer's key in any key server but this was what I needed to verify the signature for its source code. – Nomi

For octave see the answer about gpg4win app here: superuser.com/questions/1268544/… – Venality

Answer 3

You have to search the public keyservers for the given key id: in your case ID C3C45C06 Import the found key in your local keystore and after this the verification should be OK. I use Ubuntu 12.04 and it comes with Seahorse key management software. Before the key import I was seeing this:

~/Downloads$ gpg --verify --keyring ./gnu-keyring.gpg icecat-31.5.0.en-US.linux-x86_64.tar.bz2.sig icecat-31.5.0.en-US.linux-x86_64.tar.bz2
gpg: Signature made  9.03.2015 (пн) 22,35,52 EET using RSA key ID D7E04784
gpg: Can't check signature: public key not found

After the key import I was seeing this:

~/Downloads$ gpg --verify --keyring ./gnu-keyring.gpg icecat-31.5.0.en-US.linux-x86_64.tar.bz2.sig icecat-31.5.0.en-US.linux-x86_64.tar.bz2
gpg: Signature made  9.03.2015 (пн) 22,35,52 EET using RSA key ID D7E04784
gpg: Good signature from "Ruben Rodriguez (GNU IceCat releases key) <[email protected]>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: A573 69A8 BABC 2542 B5A0  368C 3C76 EED7 D7E0 4784

Stabilizer

Opened a question about this warning at superuser.com/questions/1616531/… – Pris

Answer 4

according to this http://gcc.gnu.org/mirrors.html that should be Jakub Jelinek and valid. i don't know where you would get his public key though.

Bumpkin