2

I have downloaded Debian installation iso from http://cdimage.debian.org/debian-cd/current/amd64/iso-dvd/. I have also downloaded the MD5SUMS and MD5SUMS.sign .
I verified the md5sum of iso matches the entry present in MD5SUMS .

Now I want to verify MD5SUMS file against MD5SUMS.sign using GPG. I'm not very familiar with GPG. I tried verifying using
gpg --verify MD5SUMS.sign MD5SUMS, but i got the error
gpg: Can't check signature: public key not found.

That's expected because I haven't imported the public key accompanying the sign file. I couldn't find the required key to import and debian documentation also isn't clear about this.

Debian documentation about verifying cds with gpg includes a link to Debian GPG keyring and some Key Fingerprints as below.

pub   4096R/64E6EA7D 2009-10-03
      Key fingerprint = 1046 0DAD 7616 5AD8 1FBC  0CE9 9880 21A9 64E6 EA7D
uid                  Debian CD signing key <debian-cd@lists.debian.org>

pub   4096R/6294BE9B 2011-01-05
      Key fingerprint = DF9B 9C49 EAA9 2984 3258  9D76 DA87 E80D 6294 BE9B
uid                  Debian CD signing key <debian-cd@lists.debian.org>
sub   4096R/11CD9819 2011-01-05

pub   4096R/09EA8AC3 2014-04-15
      Key fingerprint = F41D 3034 2F35 4669 5F65  C669 4246 8F40 09EA 8AC3
uid                  Debian Testing CDs Automatic Signing Key <debian-cd@lists.debian.org>
sub   4096R/6BD05CFB 2014-04-15

I don't know how to use the keyring or the key fingerprints. Please explain how can I verify the MD5SUMS file with MD5SUMS.sign file.

|improve this question
3

You missed the important line above:

gpg: Signature made Fri Sep 11 17:13:36 2015 CEST using RSA key ID 6294BE9B
gpg: Can't check signature: No public key

This tells you that this file is signed with key 6294BE9B. That is the key you need to receive first:

gpg --keyserver hkp://pool.sks-keyservers.net --recv-keys 6294BE9B

Now you can verify that the file is indeed signed with that key. - If you trust that key everything is fine.

All keyservers are usually in sync with each other. It really doesn't matter which one you use. If you are unsure whether you got the correct key, either check that the fingerprint of that key (gpg --fingerprint 6294BE9B) is the same as given on the website, or check the signatures (gpg --list-sigs 6294BE9B) of that key. (If you trust the signers of the key, you can trust the key itself.)

|improve this answer
  • Can you elaborate the command gpg --keyserver hkp://pool.sks-keyservers.net --recv-keys 6294BE9B . How can hkp://pool.sks-keyservers.net be trusted when it is not mentioned by debian? – Bharat G Dec 9 '15 at 17:26
  • 1
    I used gpg --keyserver keyring.debian.org --recv-keys 6294BE9B and it imported the key. Fingerprints matched with the ones provided by debian. And I successfully verified the MD5SUMS file. Thank you. – Bharat G Dec 9 '15 at 18:28
  • The documentation is unclear because in general it's unclear how to trust PGP keys (of people you don't already know). Checking fingerprints against debian.org/CD/verify (note encrypted HTTPS) is a good idea. You can also try --keyserver hkps://keyring.debian.org, to download the key using HTTPS. On my Fedora 25 system, GPG verifies this connection using system HTTPS certificate authorities. Sadly, Certificate Authorities are far from perfect. – sourcejedi Jan 9 '17 at 11:23
  • When you have a debian system, you can install debian-keyring, and use gpg --no-default-keyring --keyring /usr/share/keyrings/debian-role-keys.gpg – sourcejedi Jan 9 '17 at 11:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.