3

I would like to create a task for download, verify a file without public key that I will download and have a answer if it is good or not for next step.

I have done this example with linux-4.12.7.tar.gz and linux-4.12.7.tar.sign (https://www.kernel.org/signature.html).

gpg normal, I have:

~# xz -cd linux-4.12.7.tar.xz | gpg --verify linux-4.12.7.tar.sign -
gpg: assuming signed data in 'linux-4.12.7.tar'
gpg: Signature made Sun 13 Aug 2017 04:35:18 CEST
gpg:                using RSA key 647F28654894E3BD457199BE38DBBDC86092693E
gpg: Can't check signature: public key not found

gpg with status-fd, I have:

~# xz -cd linux-4.12.7.tar.xz | gpg --status-fd 1 --verify linux-4.12.7.tar.sign -
gpg: assuming signed data in 'linux-4.12.7.tar'
[GNUPG:] NEWSIG
gpg: Signature made Sun 13 Aug 2017 04:35:18 CEST
gpg:                using RSA key 647F28654894E3BD457199BE38DBBDC86092693E
[GNUPG:] ERRSIG 38DBBDC86092693E 1 8 00 1502591718 9
[GNUPG:] NO_PUBKEY 38DBBDC86092693E
gpg: Can't check signature: public key not found

I am blocked with the point, how to download the public key automatically, and after validate if it is good or not for next step? If good next step, if not stop it with an alert.

Manually, I do but how to take the key to do it automatically?

~# gpg --keyserver hkp://keys.gnupg.net --recv-keys 38DBBDC86092693E
gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: key 38DBBDC86092693E: public key "Greg Kroah-Hartman (Linux kernel stable release signing key) <greg@kroah.com>" imported
gpg: no ultimately trusted keys found
gpg: Total number processed: 1
gpg:               imported: 1

When it is good:

~# xz -cd linux-4.12.7.tar.xz | gpg --verify linux-4.12.7.tar.sign -
gpg: Signature made dim. 13 août 2017 04:35:18 CEST
gpg:                using RSA key 647F28654894E3BD457199BE38DBBDC86092693E
gpg: Good signature from "Greg Kroah-Hartman (Linux kernel stable release signing key) <greg@kroah.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 647F 2865 4894 E3BD 4571  99BE 38DB BDC8 6092 693E

For the end, if it is good, launch the next step.

Thanks in advance.

2

You can put keyserver-options auto-key-retrieve in ~/.gnupg/gpg.conf, and it will fetch any key you don't have but want to check/encrypt with.

But I don't really understand why do you want it in this case, as it's defeating the purpose of the signature verification if you're going to trust any key your downloaded blob presents.

  • Thanks for your reply! It is not possible to take the NO_PUBKEY value "38DBBDC86092693E" -> and use in the line with PK_VALUE, the ID of the public key? ~# gpg --keyserver hkp://keys.gnupg.net --recv-keys "${PK_VALUE}" – Neustradamus Aug 14 '17 at 11:48
  • keyserver-options auto-key-retrieve is semantically the same. – L29Ah Aug 14 '17 at 12:03
  • 2
    The second paragraph is the most important here: you really should know which key will be used before downloading the tarball. For stable kernel releases, it’s always Greg KH’s stable signing key. So in practice, you can hard-code the fingerprint to download in your download-and-verification script. – Stephen Kitt Aug 14 '17 at 12:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.