Re: gpg signature of leaf packages

Hi

Here the result of some more test

root@leafbuilder64:/tmp/gpgtest# gpg -k
gpg: checking the trustdb
gpg: no ultimately trusted keys found

gpg --verify webconf.signed
gpg: Signature made Sun 24 Sep 2017 02:00:47 PM CEST using DSA key ID
05B80A16
gpg: Can't check signature: public key not found
root@leafbuilder64:/tmp/gpgtest# echo $?
2

gpg --import mega.pub
gpg: key 05B80A16: public key "Erich Titl <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1
root@leafbuilder64:/tmp/gpgtest# gpg --verify webconf.signed
gpg: Signature made Sun 24 Sep 2017 02:00:47 PM CEST using DSA key ID
05B80A16
gpg: Good signature from "Erich Titl <[email protected]>"
gpg:                 aka "Erich Titl <[email protected]>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the
owner.
Primary key fingerprint: BC9A 25BC 3954 3BC8 C024  8D8A B7D4 FF9D 05B8 0A16
root@leafbuilder64:/tmp/gpgtest# echo $?
0

 gpg --edit-key [email protected]
gpg (GnuPG) 1.4.20; Copyright (C) 2015 Free Software Foundation, Inc.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.


pub  1024D/05B80A16  created: 1999-05-15  expires: never       usage: SCA
                     trust: unknown       validity: unknown
sub  2048g/F68CABB9  created: 1999-05-15  expires: never       usage: E
[ unknown] (1). Erich Titl <[email protected]>
[ unknown] (2)  Erich Titl <[email protected]>

gpg> trust
pub  1024D/05B80A16  created: 1999-05-15  expires: never       usage: SCA
                     trust: unknown       validity: unknown
sub  2048g/F68CABB9  created: 1999-05-15  expires: never       usage: E
[ unknown] (1). Erich Titl <[email protected]>
[ unknown] (2)  Erich Titl <[email protected]>

Please decide how far you trust this user to correctly verify other
users' keys
(by looking at passports, checking fingerprints from different sources,
etc.)

  1 = I don't know or won't say
  2 = I do NOT trust
  3 = I trust marginally
  4 = I trust fully
  5 = I trust ultimately
  m = back to the main menu

Your decision? 5
Do you really want to set this key to ultimate trust? (y/N) y

pub  1024D/05B80A16  created: 1999-05-15  expires: never       usage: SCA
                     trust: ultimate      validity: unknown
sub  2048g/F68CABB9  created: 1999-05-15  expires: never       usage: E
[ unknown] (1). Erich Titl <[email protected]>
[ unknown] (2)  Erich Titl <[email protected]>
Please note that the shown key validity is not necessarily correct
unless you restart the program.

root@leafbuilder64:/tmp/gpgtest# gpg --verify webconf.signed
gpg: Signature made Sun 24 Sep 2017 02:00:47 PM CEST using DSA key ID
05B80A16
gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: Good signature from "Erich Titl <[email protected]>"
gpg:                 aka "Erich Titl <[email protected]>"


Please note that the verify operation is successful even if the public
key is not trusted.

cheers

ET

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot


_______________________________________________
leaf-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/leaf-devel