1

Following these instructions, I downloaded and unpacked the kernel. https://priyachalakkal.wordpress.com/2013/01/19/verifying-digital-signature-using-gpg/

Then I tried to verify the signature but I get an unexpected error. That isn't one of the success or failure scenarios described by sites that document the basic approach.

Is there a command line flag I need to provide to tell it where to look for the public key?

~# gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 79BE3E4300411886
gpg: /root/.gnupg/trustdb.gpg: trustdb created
gpg: key 79BE3E4300411886: public key "Linus Torvalds <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1

~#  gpg --verify linux-5.6.9.tar.sign
gpg: assuming signed data in 'linux-5.6.9.tar'
gpg: Signature made Fri 01 May 2020 11:51:56 PM PDT
gpg:                using RSA key 647F28654894E3BD457199BE38DBBDC86092693E
gpg: Can't check signature: No public key

Update 1: Based on @StephenKitt's answer, I tried to grab the key indicated in the first message (in order to get it to find a user ID I had to specify the key server), but the result was not what was expected:

~# gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 647F28654894E3BD457199BE38DBBDC86092693E
gpg: key 38DBBDC86092693E: public key "Greg Kroah-Hartman <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1

~# gpg --verify linux-5.6.9.tar.sign
gpg: assuming signed data in 'linux-5.6.9.tar'
gpg: Signature made Fri 01 May 2020 11:51:56 PM PDT
gpg:                using RSA key 647F28654894E3BD457199BE38DBBDC86092693E
gpg: Good signature from "Greg Kroah-Hartman <[email protected]>" [unknown]
gpg:                 aka "Greg Kroah-Hartman <[email protected]>" [unknown]
gpg:                 aka "Greg Kroah-Hartman (Linux kernel stable release signing key) <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!

gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 647F 2865 4894 E3BD 4571 99BE 38DB BDC8 6092 693E

Update 2: With some googling I was able to figure out what to do about the non-trusted signature warning (see comment/reply to Stephen in the respective answer)

~# gpg2 --tofu-policy good 647F28654894E3BD457199BE38DBBDC86092693E
gpg: Setting TOFU trust policy for new binding <key: 647F28654894E3BD457199BE38DBBDC86092693E, user id: Greg Kroah-Hartman <[email protected]>> to good.
gpg: Setting TOFU trust policy for new binding <key: 647F28654894E3BD457199BE38DBBDC86092693E, user id: Greg Kroah-Hartman <[email protected]>> to good.
gpg: Setting TOFU trust policy for new binding <key:     647F28654894E3BD457199BE38DBBDC86092693E, user id: Greg Kroah-Hartman (Linux kernel stable release signing key) <[email protected]>> to good.

~# gpg2 --trust-model tofu --verify linux-5.6.9.tar.sign
gpg: assuming signed data in 'linux-5.6.9.tar'
gpg: Signature made Fri 01 May 2020 11:51:56 PM PDT
gpg:                using RSA key 647F28654894E3BD457199BE38DBBDC86092693E
gpg: Good signature from "Greg Kroah-Hartman <[email protected]>" [full]
gpg:                 aka "Greg Kroah-Hartman <[email protected]>" [full]
gpg:                 aka "Greg Kroah-Hartman (Linux kernel stable release signing key) <[email protected]>" [full]
gpg: [email protected]: Verified 1 signatures in the past 0 seconds.
 Encrypted 0 messages.
gpg: [email protected]: Verified 1 signatures in the past 0 seconds.  Encrypted
 0 messages.
gpg: [email protected]: Verified 1 signatures in the past 0 seconds.  Encrypted
 0 messages.

1 Answer 1

5

You don’t have the right key; the 5.6.9 archive is signed by Greg Kroah-Hartman, not Linus. Running

gpg --recv-keys 647F28654894E3BD457199BE38DBBDC86092693E

will allow you to verify the archive. (This is the fingerprint from your second gpg invocation.)

The message you get after retrieving the key indicates two things:

  • the archive’s signature is good (“Good signature from” ...);
  • but you have no proof that the key you downloaded really is Greg’s.

Basically, this means that you can trust the archive, as long as you trust the key. GPG maintains a trust database, which tracks links from your key to others; most people (including you) don’t have any. This is based on the web of trust, and is considered impractical as a general-purpose tool; in most cases, “trust on first use” (TOFU) is simpler and just as useful. You can change the trust model with the --trust-model option; see the GnuPG manual for details (and discussion).

4
  • I updated the question in response to your answer. I had to specify the key server to find the user ID but I still could not verify the archive. Do you know what might be going on there? Another flag to add? I can do some googling... (I would like to solve this, however I was able to install 5.6 from packages and it just worked).
    – clearlight
    Commented Sep 3, 2020 at 12:59
  • Aha! I found something that explains that warning and what to do about it: kernel.org/signature.html Further, in the process of running the tofu command I discovered gnupg2 package was not installed on my new Linux install so I wonder if that's why I had to manually specify the keyserver and others don't?
    – clearlight
    Commented Sep 3, 2020 at 13:05
  • Yup. And if it helps at all, my key is connected to Greg’s, so I’m confident that the fingerprint you used is truly his. Commented Sep 3, 2020 at 13:09
  • The keyserver depends on your configuration; I don’t remember the gpg1 v. gpg2 defaults. Commented Sep 3, 2020 at 13:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .