4 ms·
So you pull the package down and the signature checks out to some key on a pgp key server. How do you know it's the correct key?
by __david__ 10y ago
So you pull the package down and the signature checks out to some key on a pgp key server. How do you know it's the correct key?
- falcolas 10y agoGenerally, the key already exists on your system, as it's coming through the official channels. If you decide to add the cert manually, you can inspect the key and see who has signed it, and decide your level of trust. With HTTPS, you only ever have the choice of trusting the 1000+ CAs in your keyring.
- oconnore 10y ago> If you decide to add the cert manually, you can inspect the key and see who has signed it, and decide your level of trust. No one has signed it, because the mythical web of trust does not exist. What now?
- falcolas 10y agoContact the developer (say, over IRC, Slack, email, GitHub, etc), and ask them to sign a sentence you provide with it. Then you can sign their key.