Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #185800

Re: Public Key

Show all headers | View raw

On 08/23/2017 07:24 PM, Mario Castelán Castro wrote:
> On 23/08/17 15:11, Dan Norton wrote:
>> #1 SMP Debian 3.16.43-2+deb8u2 (2017-06-26)
>> is on my desktop. In the process of installing borg from:
>>
>> https://github.com/borgbackup/borg/releases
> You can install it easily in Debian. The package is called “borgbackup”.
> However, in Debian 9 it is an older version. If you want the latest
> version in Debian 9 you will have to install from the sources.
I'm all for that, but unfortunately...
$ apt-cache show borgbackup | grep ^Homepage
E: No packages found

Before posting I searched for borg and because nothing turned up I tried 
to install it another way. It's supposed to be a self-contained binary; 
the simplicity is appealing, but it's gotta be the real thing (not 
spoofed).
>
>> sudo apt-key add borg-linux64.gpg
> There is no reason to do this. You should not change the apt-get keys
> lightly. To install from source, there is no reason to add more trusted
> keys to apt-get.
Glad to learn this now.
>
>> If nothing is amiss so far (a big if), the problem now is:
>>
>> $ gpg --verify borg-linux64.asc borg-linux64
>> gpg: Signature made Sun 23 Jul 2017 07:23:38 PM EDT using RSA key ID
>> 51F78E01
>> gpg: Can't check signature: public key not found
>>
>> How to get the public key?
> See
> <https://borgbackup.readthedocs.io/en/stable/support.html#security-contact>.
>
> A key may claim to belong to X person, but you should not take the key's
> word for granted. You must verify that X person indeed owns that key.
> The best way to do this is that the person gives you face to face his
> gpg key. Second best is using the OpenPGP web of trust.
>
> In your case, probably neither option is possible, at least not
> immediately (joining the web of trust usually requires physically
> traveling to key signing parties, or something similar). The best you
> can do is to trust the key given by the official borg page.
>
> How do you know what is the official borg page? You should not trust a
> search engine for this, nor what the page itself claim, but you can
> trust the Debian developers (not because they are special, but because
> you are trusting them by using Debian).
>
> To see the home-page of a package in Debian, do as follows:
>
> $ apt-cache show borgbackup | grep ^Homepage
> Homepage: https://borgbackup.github.io/borgbackup/
I like what you are saying. Now, if that package could be found we'd be 
in business.
>
> After some clicks, starting in this page, you will end in the page I
> mentioned (which is
> <https://borgbackup.readthedocs.io/en/stable/support.html#security-contact>).
>
> After you have followed this procedure to obtain a fingerprint of the
> borg developer that signs the release, fetch the key with the following
> command (substitute FINGERPRINT with the actual fingerprint. You need
> not delete the spaces in the fingerprint, but do not delete the single
> quotation marks in the command):
>
> gpg --keyserver 'hkps://hkps.pool.sks-keyservers.net' --recv-key
> 'FINGERPRINT'
How do we know about 'hkps://hkps.pool.sks-keyservers.net'? I tried the 
command...

$ gpg --keyserver 'hkps://hkps.pool.sks-keyservers.net' --recv-key '<the 
key>'
gpg: requesting key FAF7B393 from hkps server hkps.pool.sks-keyservers.net
gpgkeys: HTTP fetch error 1: unsupported protocol
gpg: no valid OpenPGP data found.
gpg: Total number processed: 0



>
> Regards.
>

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Public Key Dan Norton <dnorton@mindspring.com> - 2017-08-23 23:10 +0200
  Re: Public Key Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-08-24 01:30 +0200
    Re: Public Key Dan Norton <dnorton@mindspring.com> - 2017-08-24 02:40 +0200
      Re: Public Key Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-08-24 03:00 +0200
        Re: Public Key Dan Norton <dnorton@mindspring.com> - 2017-08-24 03:50 +0200
          Re: Public Key Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-08-24 04:10 +0200
            Re: Public Key Greg Wooledge <wooledg@eeg.ccf.org> - 2017-08-24 14:00 +0200
            Re: Public Key Dan Norton <dnorton@mindspring.com> - 2017-08-24 17:20 +0200
              Re: Public Key Mario Castelán Castro <marioxcc.MT@yandex.com> - 2017-08-24 18:20 +0200

csiph-web