I have downloaded Debian installation iso from http://cdimage.debian.org/debian-cd/current/amd64/iso-dvd/. I have also downloaded the MD5SUMS and MD5SUMS.sign .
I verified the md5sum of iso matches the entry present in MD5SUMS .
Now I want to verify MD5SUMS file against MD5SUMS.sign using GPG. I'm not very familiar with GPG. I tried verifying using
gpg --verify MD5SUMS.sign MD5SUMS, but i got the error
gpg: Can't check signature: public key not found.
That's expected because I haven't imported the public key accompanying the sign file. I couldn't find the required key to import and debian documentation also isn't clear about this.
pub 4096R/64E6EA7D 2009-10-03 Key fingerprint = 1046 0DAD 7616 5AD8 1FBC 0CE9 9880 21A9 64E6 EA7D uid Debian CD signing key <firstname.lastname@example.org> pub 4096R/6294BE9B 2011-01-05 Key fingerprint = DF9B 9C49 EAA9 2984 3258 9D76 DA87 E80D 6294 BE9B uid Debian CD signing key <email@example.com> sub 4096R/11CD9819 2011-01-05 pub 4096R/09EA8AC3 2014-04-15 Key fingerprint = F41D 3034 2F35 4669 5F65 C669 4246 8F40 09EA 8AC3 uid Debian Testing CDs Automatic Signing Key <firstname.lastname@example.org> sub 4096R/6BD05CFB 2014-04-15
I don't know how to use the keyring or the key fingerprints. Please explain how can I verify the MD5SUMS file with MD5SUMS.sign file.