I have never used PGP nor GnuPG, but I understand that it has more features beyond using say MD5 to verify my downloads. I noticed Wine has a .sign file (i.e. wine-0.9.40.tar.bz2.sign for wine-0.9.40.tar.bz2). I installed http://macgpg.sourceforge.net/ (which has an MD5 for download verification), and since I never used PGP/GnuPG, the instructions seem to just say to create a keypair, which I did. How do I verify my wine download? Whether I use: gpg wine-0.9.40.tar.bz2.sign or gpg --verify wine-0.9.40.tar.bz2.sign wine-0.9.40.tar.bz2 I receive: gpg: Signature made Fri Jun 29 12:38:13 2007 CDT using DSA key ID B9461DD7 gpg: Can't check signature: public key not found Do I need to get a public key from the download mirror server? How? Regards.
On Monday 02 July 2007 21:27, Dee Ayy wrote:> I receive: > gpg: Signature made Fri Jun 29 12:38:13 2007 CDT using DSA key ID B9461DD7 > gpg: Can't check signature: public key not foundYou can find a key using public key servers, which can be easily found using google (with "public key server" request). The author of the key you are looking for is "Alexandre Julliard <julliard@winehq.org>". One of the key servers i've been using is http://keyserver.veridis.com:11371/ . Here is a copy of that key I've been using to verify wine packages: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: FileCrypt KeyServer 2.1.3 mQGiBEFkvAIRBADV3gAdcYUPI3KXIDX6wB160rCEB0yihD1hsbF5nAHOEI1TfvSC 4OypNTlYVRULQVzA04bGqq7LzkS+v/tKrhITX79kuFsB/0/xpOHL5QgB5ZxJjlVU cqvGfI7lsVnKq6B6bR6byOoKhbdllg5fLnH2j2VHT3jRrpDVbc8I774tDwCg4me5 04/47YNipO1gkZC1CwkcK3ED/21m1iWhmYsGtq3RlqjnJnc3CFAvS1353fnRUKtj Ek8h1Ezg4PvB9h+2pLRk2wsgwePd0o7bYE34vr2Hclhz1ZqvP06yf5ixGHJcBC1f HluztRk3YUuCn6vyaogeHsB1X6lkovk3L1i2REni+b6nYE3Ma/yv1lyt3K/VcsO5 Jf9rBADUAsQti2g3S0SlBhnaxYXD1WArbkexixUjg2uJykfQzyjj+zXYa/ksyx9R etQN6RIQMajMFcjWMtsWScyui0bdvIC5ebwyC8AXorrTIOLoc5myf9wvPIJcDu/l jCWTSehD+EPZJ6o3xM9ZnA1GpX6F/vxb670F726oWpUld3EqwbQoQWxleGFuZHJl IEp1bGxpYXJkIDxqdWxsaWFyZEB3aW5laHEub3JnPohfBBMRAgAfBQJC7PLTAhsD BwsJCAcDAgEDFQIDAxYCAQIeAQIXgAAKCRD15unuuUYd19ODAKCbdkxqjwD25cLW Sfk2R3gwPwk7mgCePMO/NKCWBfDvSEIqNLIPRiUt0xa5AQ0EQWS8BBAEAIb/ofti H/0VNftT/ShtJf+bnU5W69FAk81piGl9OEAPgfPWQHejqssU3gl2OCvNqi3NrHj4 fuuNgiSHRlpw362XneHluDAiDfhzStwrQ9+6JbsNi34JCQrkJnt8/GpDHlPt9RDQ q+sqF/fLnoNMGrspt+sTZXF8qA63OQ4d/uWfAAMFA/922zPoAm2NE1rhHeBlGNaQ 300dBFiFU8GhjMDx53tkMCBJ0KK05UGOaRBTJcNdq2fXZB3O0kCDPPe2SWV019gM FX29lisu6tVxXnLMplIdL5hFZLOD1guNhN/jVVy64Ext6ZXap8sAtPF/6E5SfH0A 8ctE5qLs9z/xB6uQuLlPX4hJBBgRAgAJBQJBZLwEAhsMAAoJEPXm6e65Rh3XC20A oLoLZtQhz3a12+g2/bwfVBk7vaPQAKCsbpOccmF9882EQA6gLNqfv2d4mw==jwN/ -----END PGP PUBLIC KEY BLOCK----- paste it to a file using any text editor and use "gpg --import". Have a nice day. With best regards, Victor Eremin.