gpg 校验文件

最新推荐文章于 2024-10-24 17:33:21 发布

原创

最新推荐文章于 2024-10-24 17:33:21 发布 · 1k 阅读

1 ·

CC 4.0 BY-SA版权

本文介绍了如何使用GPG（GNU Privacy Guard）工具验证文件的数字签名。通过获取并导入所需的Key ID，可以解决无法校验文件的问题。在导入Key ID后，GPG能够确认文件来自可信来源，并在设置为完全信任后，消除警告信息。

$ gpg httpd-2.0.55.tar.gz.asc

gpg: Signature made Monday 10 October 2005 07:05:15 AM IST using RSA key ID 10FDE075
gpg: Can't check signature: public key not found

没有 Key ID ，当然也就无法校验文件
% gpg --verify apache_2.2.11-win32-x86-no_ssl.msi.asc
Warning: using insecure memory!
gpg: Signature made Wed Dec 10 15:32:32 2008 CST using RSA key ID CB9B9EC5
gpg: Can't check signature: No public key

所以要导入 key ID。这里用 --recv-keys
% gpg --recv-keys CB9B9EC5

( or $ gpg --keyserver pgpkeys.mit.edu --recv-key 10FDE075 )

Warning: using insecure memory!
gpg: requesting key CB9B9EC5 from hkp server keys.gnupg.net
gpg: key B55D9977: public key "William A. Rowe, Jr. <wrowe@rowe-clan.net>" imported
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: Total number processed: 1
gpg: imported: 1 (RSA: 1)

导入完成后，再来校验，就OK了。
% gpg --verify apache_2.2.11-win32-x86-no_ssl.msi.asc
Warning: using insecure memory!
gpg: Signature made Wed Dec 10 15:32:32 2008 CST using RSA key ID CB9B9EC5
gpg: Good signature from "William A. Ro