Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #262231 > unrolled thread

Need help with PGP signature verification

Back to article view | Back to linux.debian.user

Contents

  Need help with PGP signature verification Tom Browder <tom.browder@gmail.com> - 2023-10-08 01:20 +0200
    Re: Need help with PGP signature verification "Thomas Schmitt" <scdbackup@gmx.net> - 2023-10-08 09:10 +0200
      Re: Need help with PGP signature verification debian-user@howorth.org.uk - 2023-10-08 19:40 +0200
    Re: Need help with PGP signature verification Tom Browder <tom.browder@gmail.com> - 2023-10-08 12:20 +0200
      Re: Need help with PGP signature verification Dan Purgert <dan@djph.net> - 2023-10-08 13:10 +0200
      Re: Need help with PGP signature verification "Thomas Schmitt" <scdbackup@gmx.net> - 2023-10-08 14:30 +0200
        Re: Need help with PGP signature verification Tom Browder <tom.browder@gmail.com> - 2023-10-08 22:20 +0200
      Re: Need help with PGP signature verification Tom Browder <tom.browder@gmail.com> - 2023-10-08 14:30 +0200
        Re: Need help with PGP signature verification "Thomas Schmitt" <scdbackup@gmx.net> - 2023-10-08 14:40 +0200

#262231 — Need help with PGP signature verification

[Multipart message — attachments visible in raw view] — view raw

I'm willing to trust published PGP key fingerprints for signers of Rakudo
downloadable files.

Question:  How can I get the fingerprint from the downloads?

The products I download are (1) the file of interest, (2) a PGP signed
checksums file with various shaX hashes for the file, and (3) a separate
file containing a PGP signature.

Thanks so much.

-Tom

[toc] | [next] | [standalone]

#262233

Hi,

Tom Browder wrote:
> I'm willing to trust published PGP key fingerprints for signers of Rakudo
> downloadable files.

Do i get it right that you talk about https://rakudo.org/downloads ?

> Question:  How can I get the fingerprint from the downloads? 
> The products I download are (1) the file of interest, (2) a PGP signed
> checksums file with various shaX hashes for the file, and (3) a separate
> file containing a PGP signature.

The "Verify" button at above web page leads to
  https://rakudo.org/downloads/verifying
which explains how to use sha256 and gpg2 for verification.
Most importantly it lists the fingerprints of the four "Keys of the
releasers". If gpg2 --verify reports any other fingerprint, then the .asc
file cannot be trusted.

(It is not overly trustworthy that fingerprints and the signed files
are offered on the same web site. Once the site is compromised, both can
be manipulated by the attacker.)


Have a nice day :)

Thomas

[toc] | [prev] | [next] | [standalone]

#262259

"Thomas Schmitt" <scdbackup@gmx.net> wrote:
> Hi,
> 
> Tom Browder wrote:
> > I'm willing to trust published PGP key fingerprints for signers of
> > Rakudo downloadable files.  
> 
> Do i get it right that you talk about https://rakudo.org/downloads ?
> 
> > Question:  How can I get the fingerprint from the downloads? 
> > The products I download are (1) the file of interest, (2) a PGP
> > signed checksums file with various shaX hashes for the file, and
> > (3) a separate file containing a PGP signature.  
> 
> The "Verify" button at above web page leads to
>   https://rakudo.org/downloads/verifying
> which explains how to use sha256 and gpg2 for verification.
> Most importantly it lists the fingerprints of the four "Keys of the
> releasers". If gpg2 --verify reports any other fingerprint, then
> the .asc file cannot be trusted.
> 
> (It is not overly trustworthy that fingerprints and the signed files
> are offered on the same web site. Once the site is compromised, both
> can be manipulated by the attacker.)

That's why the page suggests that the developers' also list their
fingerprints on their github pages, I suspect. Which they do.

[toc] | [prev] | [next] | [standalone]

#262241

On Sun, Oct 8, 2023 at 3:29 AM DdB
<debianlist@potentially-spam.de-bruyn.de> wrote:
> Am 08.10.2023 um 01:16 schrieb Tom Browder:
> > I'm willing to trust published PGP key fingerprints for signers of
> > Rakudo downloadable files.
> > Question:  How can I get the fingerprint from the downloads?
> There is more than just one way to archieve this, first result from

I should have been more specific. I have the following:

-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQTdpb2j9c3OmfntVsEsxulzgY84awUCZQ1GBgAKCRAsxulzgY84
a+jhAQCZ0lLh1EnB1AwrgW0zPBp801OOeJ2QUiDBOGXBbrl/7QD/ZQe738sF2tCR
43SAvJOfT3b4YpGdfSUj9F7XNDoovQM=
=mNqK
-----END PGP SIGNATURE-----

I need the fingerprint from that to compare with the fingerprints I
know from Github to see if it's from the same key.

I think using openssl might be the easiest, but all the tools seem to
have a huge number of options and a vocabulary that's very malleable.

Thanks.

-Tom

[toc] | [prev] | [next] | [standalone]

#262242

[Multipart message — attachments visible in raw view] — view raw

On Oct 08, 2023, Tom Browder wrote:
> On Sun, Oct 8, 2023 at 3:29 AM DdB
> <debianlist@potentially-spam.de-bruyn.de> wrote:
> > Am 08.10.2023 um 01:16 schrieb Tom Browder:
> > > I'm willing to trust published PGP key fingerprints for signers of
> > > Rakudo downloadable files.
> > > Question:  How can I get the fingerprint from the downloads?
> > There is more than just one way to archieve this, first result from
> 
> I should have been more specific. I have the following:
> 
> -----BEGIN PGP SIGNATURE-----
> 
> iHUEABYKAB0WIQTdpb2j9c3OmfntVsEsxulzgY84awUCZQ1GBgAKCRAsxulzgY84
> a+jhAQCZ0lLh1EnB1AwrgW0zPBp801OOeJ2QUiDBOGXBbrl/7QD/ZQe738sF2tCR
> 43SAvJOfT3b4YpGdfSUj9F7XNDoovQM=
> =mNqK
> -----END PGP SIGNATURE-----
> 
> I need the fingerprint from that to compare with the fingerprints I
> know from Github to see if it's from the same key.

No, you just need the key(s) from the developer(s).  Assuming you've not
accidentally tampered with the files, you'll be able to verify this
signature with a command like "gpg --verify shasum.txt.gpg shasum.txt".

You'll get a message to the effect of 

  Signature made [some-date-here]
      using RSA Key [fingerprint-here]
  Good signature from "Some Person's GPG Key Name"

NOTE -- you MAY also receive some lines to the effect of 

  WARNING: This key is not trusted, the authenticity of the signature
      cannot be verified.

As with checking a Debian ISO (or other Linux distro that uses this
style of verification), this is nothing to be worried about, it's just
GPG informing you that it doesn't have any information as to whether you
actually "trust" the key (either through you explicitly signing /
trusting the key, or trust being derived through the GPG Web of Trust).
It's roughly the GPG equivalent of a web browser going "WARNING - Self
Signed Certificate".


Anyway, once you're done with this; then you know the sha256 checksum
file is the one the developers intended you to get; and you can use it
to check the *iso file.  Probably something like "sha256sum
--ignore-missing -c sha256sum.txt"

HTH :)

-- 
|_|O|_|
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: DDAB 23FB 19FA 7D85 1CC1  E067 6D65 70E5 4CE7 2860

[toc] | [prev] | [next] | [standalone]

#262247

Hi,

maybe

  gpg --keyid-format long --verify signature_file.asc /some/dummy/file

this gives me the last 16 characters of the fingerprint. Like:

  gpg:                using .... key E9CBDFC0ABC0A854

with a matching payload file i get something like:

  Primary key fingerprint: 44BC 9FD0 D688 EB00 7C4D D029 E9CB DFC0 ABC0 A854


Have a nice day :)

Thomas

[toc] | [prev] | [next] | [standalone]

#262260

[Multipart message — attachments visible in raw view] — view raw

On Sun, Oct 8, 2023 at 14:39 Thomas Schmitt <scdbackup@gmx.net> wrote:

> Hi,


Thanks, Thomas.

I did get the signers key fingeprints from their personal github pages. I
would go the full security route if it were only my use I'm concerned with,
but I'm working on a Raku module for others and I don't want them to be
held up by having to fumble with key trust before at least downloading the
files with a first order check with data I can provide.

I'll make sure to document exactly what I'm providing.

Best regards,

-Tom

[toc] | [prev] | [next] | [standalone]

#262248

[Multipart message — attachments visible in raw view] — view raw

On Sun, Oct 8, 2023 at 05:13 Tom Browder <tom.browder@gmail.com> wrote:

> On Sun, Oct 8, 2023 at 3:29 AM DdB
> <debianlist@potentially-spam.de-bruyn.de> wrote:
> > Am 08.10.2023 um 01:16 schrieb Tom Browder:
> > > I'm willing to trust published PGP key fingerprints for signers of
> > > Rakudo downloadable files.
> > > Question:  How can I get the fingerprint from the downloads?


I found a usable answer. Run "gpg file.asc" and the output shows the two
fingerprints: the primary key fingerprint and the subkey fingerprint.

I wish there was a PGP cookbook around somewhere.

Thanks, all.

-Tom

[toc] | [prev] | [next] | [standalone]

#262250

Hi,

Tom Browder wrote:
> I found a usable answer. Run "gpg file.asc" and the output shows the two
> fingerprints: the primary key fingerprint and the subkey fingerprint.

Wow, that's surprising.

But indeed the man page says:

  COMMANDS
   ...
   gpg  may  be run with no commands, in which case it will perform a rea‐
   sonable action depending on the type of file it is given as  input  (an
   encrypted  message  is  decrypted, a signature is verified, a file con‐
   taining keys is listed).


Have a nice day :)

Thomas

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web