Hi Matthew.
The public key is often located at the same server you get the code
from.
If you look att the link you named, you can download nut-2.0.2.tar.gz
and the signature. The signature is the gpg key file.
If You run FC (RedHat) you have the gpg checked by the rpm system.
The same goes for every system that use the rpm system like Suse
Mandrake ....
In Gentoo the portage check the files on emerge.
But if you take the code from cvs, you have to trust the developers.
that the code is ok.
/Kjell
fre 2006-01-27 klockan 12:51 -0800 skrev
Matthew.van.Eerde@hbinc.com:> I've successfully installed and configured NUT on my test machine and
am moving it into production.
>
> http://www.networkupstools.org/source.html offers some good advice...
"You should always use PGP/GPG to verify the signatures before using any
source code"
>
> But where can I find the public key that was used to sign the source?
It's not on any key servers I've been able to query.
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Detta =?ISO-8859-1?Q?=E4r?= en digitalt signerad
meddelandedel
Url :
http://lists.alioth.debian.org/pipermail/nut-upsuser/attachments/20060128/de4f80a6/attachment.pgp