2 ms·
"If you're downloading the signature each time you're downloading a new version of a package or iso, and its SHAs, you're using GPG incorrectly." I believe you
by pferde 11y ago
"If you're downloading the signature each time you're downloading a new version of a package or iso, and its SHAs, you're using GPG incorrectly."
I believe you're confusing a PGP public key with a PGP signature for a particular file (made using said public key).
- jnbiche 11y agoThank you, that was indeed a typo I wrote as I rushed to get out the door earlier. I obviously meant to write "if you're downloading the public key" (indeed, I referred to "download the public key of the signer" in two paragraphs up, so I suspect that was clear to most people reading). The hashes for each new version are what are signed, obviously (with the private key of the maintainer). My sentence about "trusted signature" could have been clearer, too. You have a public key that you trust, that you leverage to verify any new materials signed by the package/distro maintainer. So by extension, you can trust the signed hashes. I've been using PGP/GPG on a regular basis since 1998, so I'm pretty used to the workflow by now and not at all confused about key pairs and signatures (although I will admit that I sometimes got confused about the point of subkeys until I read this a few years ago: https://alexcabal.com/creating-the-perfect-gpg-keypair/ https://alexcabal.com/creating-the-perfect-gpg-keypair/)
- pferde 11y agoYeah, I figured out that you merely made a simple mistake, since rest of your comment makes all kinds of sense. :) Apologies in case I sounded like I wanted to put you down.