3

I would like to create a task for download, verify a file without public key that I will download and have a answer if it is good or not for next step.

I have done this example with linux-4.12.7.tar.gz and linux-4.12.7.tar.sign (https://www.kernel.org/signature.html).

gpg normal, I have:

~# xz -cd linux-4.12.7.tar.xz | gpg --verify linux-4.12.7.tar.sign -
gpg: assuming signed data in 'linux-4.12.7.tar'
gpg: Signature made Sun 13 Aug 2017 04:35:18 CEST
gpg:                using RSA key 647F28654894E3BD457199BE38DBBDC86092693E
gpg: Can't check signature: public key not found

gpg with status-fd, I have:

~# xz -cd linux-4.12.7.tar.xz | gpg --status-fd 1 --verify linux-4.12.7.tar.sign -
gpg: assuming signed data in 'linux-4.12.7.tar'
[GNUPG:] NEWSIG
gpg: Signature made Sun 13 Aug 2017 04:35:18 CEST
gpg:                using RSA key 647F28654894E3BD457199BE38DBBDC86092693E
[GNUPG:] ERRSIG 38DBBDC86092693E 1 8 00 1502591718 9
[GNUPG:] NO_PUBKEY 38DBBDC86092693E
gpg: Can't check signature: public key not found

I am blocked with the point, how to download the public key automatically, and after validate if it is good or not for next step? If good next step, if not stop it with an alert.

Manually, I do but how to take the key to do it automatically?

~# gpg --keyserver hkp://keys.gnupg.net --recv-keys 38DBBDC86092693E
gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: key 38DBBDC86092693E: public key "Greg Kroah-Hartman (Linux kernel stable release signing key) <[email protected]>" imported
gpg: no ultimately trusted keys found
gpg: Total number processed: 1
gpg:               imported: 1

When it is good:

~# xz -cd linux-4.12.7.tar.xz | gpg --verify linux-4.12.7.tar.sign -
gpg: Signature made dim. 13 août 2017 04:35:18 CEST
gpg:                using RSA key 647F28654894E3BD457199BE38DBBDC86092693E
gpg: Good signature from "Greg Kroah-Hartman (Linux kernel stable release signing key) <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 647F 2865 4894 E3BD 4571  99BE 38DB BDC8 6092 693E

For the end, if it is good, launch the next step.

Thanks in advance.

1 Answer 1

2

You can put keyserver-options auto-key-retrieve in ~/.gnupg/gpg.conf, and it will fetch any key you don't have but want to check/encrypt with.

But I don't really understand why do you want it in this case, as it's defeating the purpose of the signature verification if you're going to trust any key your downloaded blob presents.

3
  • Thanks for your reply! It is not possible to take the NO_PUBKEY value "38DBBDC86092693E" -> and use in the line with PK_VALUE, the ID of the public key? ~# gpg --keyserver hkp://keys.gnupg.net --recv-keys "${PK_VALUE}" Commented Aug 14, 2017 at 11:48
  • keyserver-options auto-key-retrieve is semantically the same.
    – L29Ah
    Commented Aug 14, 2017 at 12:03
  • 2
    The second paragraph is the most important here: you really should know which key will be used before downloading the tarball. For stable kernel releases, it’s always Greg KH’s stable signing key. So in practice, you can hard-code the fingerprint to download in your download-and-verification script. Commented Aug 14, 2017 at 12:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .