I download a deb package from GitHub, specifically gcm-linux_amd64.2.0.785.deb

How can I tell if the package is signed and how can I verify the signature?

I tried some dpkg commands. These seem to show the package is signed with a key BE1229CF.

> dpkg-sig --verify gcm-linux_amd64.2.0.785.deb
Processing gcm-linux_amd64.2.0.785.deb...
UNKNOWNSIG _gpgorigin BE1229CF
> debsig-verify gcm-linux_amd64.2.0.785.deb 
debsig: Could not open Origin directory /etc/debsig/policies/EB3E94ADBE1229CF: No such file or directory

This key is published at https://packages.microsoft.com/keys/microsoft.asc

> gpg microsoft.asc 
gpg: WARNING: no command supplied.  Trying to guess what you mean ...
pub   rsa2048 2015-10-28 [SC]
uid           Microsoft (Release signing) <[email protected]>

but I'm still not sure how to verify

Aha after gpg --import microsoft.asc it recognises the key, but it still fails BADSIG.

> dpkg-sig --verify gcm-linux_amd64.2.0.785.deb
Processing gcm-linux_amd64.2.0.785.deb...
BADSIG _gpgorigin
  • 1
    When GPG fingerprints are abbreviated, you use the last X characters. BC528686B50D79E339D3721CEB3E94ADBE1229CF can be abbreviated to its last 16 characters (EB3E94ADBE1229CF) or its last 8 characters (BE1229CF). That key you are using probably matches. You just need to import it as a public key.
    – Stewart
    Jul 27, 2022 at 11:46
  • 2
    I imagine you posted this issue, right? I suspect you’ll get a better answer there than here ;-). Jul 27, 2022 at 12:17


You must log in to answer this question.

Browse other questions tagged .