I have downloaded Debian installation iso from http://cdimage.debian.org/debian-cd/current/amd64/iso-dvd/. I have also downloaded the MD5SUMS and MD5SUMS.sign .
I verified the md5sum of iso matches the entry present in MD5SUMS .
Now I want to verify MD5SUMS file against MD5SUMS.sign using GPG. I'm not very familiar with GPG. I tried verifying using
gpg --verify MD5SUMS.sign MD5SUMS
, but i got the error
gpg: Can't check signature: public key not found
.
That's expected because I haven't imported the public key accompanying the sign file. I couldn't find the required key to import and debian documentation also isn't clear about this.
Debian documentation about verifying cds with gpg includes a link to Debian GPG keyring and some Key Fingerprints as below.
pub 4096R/64E6EA7D 2009-10-03
Key fingerprint = 1046 0DAD 7616 5AD8 1FBC 0CE9 9880 21A9 64E6 EA7D
uid Debian CD signing key <debian-cd@lists.debian.org>
pub 4096R/6294BE9B 2011-01-05
Key fingerprint = DF9B 9C49 EAA9 2984 3258 9D76 DA87 E80D 6294 BE9B
uid Debian CD signing key <debian-cd@lists.debian.org>
sub 4096R/11CD9819 2011-01-05
pub 4096R/09EA8AC3 2014-04-15
Key fingerprint = F41D 3034 2F35 4669 5F65 C669 4246 8F40 09EA 8AC3
uid Debian Testing CDs Automatic Signing Key <debian-cd@lists.debian.org>
sub 4096R/6BD05CFB 2014-04-15
I don't know how to use the keyring or the key fingerprints. Please explain how can I verify the MD5SUMS file with MD5SUMS.sign file.