I've just downloaded a FreeBSD 11.0 iso file from the FreeBSD website. I've also obtained the signed SHA512 and SHA256 checksum files. The website says that the checksum files are PGP-signed. How do I verify the integrity of the downloaded iso? Where do I get the public key to verify the signature in the checksum files?
Add a comment
|
If you are in a Linux / Unix-like system,
sha256sum /path/to/freebsd.iso
sha512sum /path/to/freebsd.iso
will print the checksums.
The public PGP key is likely one of these.
-
Do you know which key exactly? I downloaded the complete keyring. The download was successfully verified, but now I have hundreds(?) of keys I'll not be using again. – Flux Feb 26 '17 at 12:33
-
It turns out this piece of information is really hard to find in the internet. I did some research but could not find it. This should be explicitly documented somewhere. I think you could infer it from your local keyring (a good topic for another question) and then, if you want, send a suggestion to FreeBSD developers to document it explicitly in the Download page. – thiagowfx Feb 26 '17 at 18:01
