Re: verifiyng the ABCL packages

> On Aug 19, 2023, at 20:18, cage <[email protected]> wrote:
>=20
> Hi!
>=20
> Sorry if  this question sounds  trivial (likely it  is) but how  can I
> verify the packages downloaded on the ABCL website?
>=20
> I am able to download the signature file (*.asc) but I do not know how
> to find the public key to match the signature.
>=20
> ----------------
> $ gpg --verify abcl-bin-1.9.2.tar.gz.asc
> gpg: assuming signed data in 'abcl-bin-1.9.2.tar.gz'
> gpg: Signature made Wed Jun 21 10:01:48 2023 CEST
> gpg:                using DSA key =
5491D207FF9ECDE0BEA277772A9641104DB1773D
> [...]
> gpg: Can't check signature: No public key
> ----------------            ^^^^^^^^^^^^^
>=20

[I responded to you in #abcl, but you didn=E2=80=99t return to read the =
memo].

Most (all) ABCL releases have been signed with my personal key =
associated with <[email protected]>.  This key was listed in the =
HKP databases ("openpgp.mit.edu"?), but I guess they got taken down =
after the poisoning attack (3-4 years ago?).  The key now seems to be =
listed with keys.openpgp.org <http://keys.openpgp.org/>.  Is that enough =
for you to trust the key, or would you like me to make some sort of =
cryptographic commitment that this is my key? =20

[0]: =
<https://irclog.tymoon.eu/libera/%23abcl?around=3D1692513899#1692513899>

[1]: =
<https://keys.openpgp.org/vks/v1/by-fingerprint/5491D207FF9ECDE0BEA277772A=
9641104DB1773D>

yours in CONS,
Mark <[email protected] <mailto:[email protected]>>


--
"A screaming comes across the sky.  It has happened before but there is =
nothing=20
to compare to it now."