4 messages, 3 authors, 2021-01-24 · open the first message on its own page
From: Brooke Kuhlmann <hidden>
Date: 2021-01-24 16:50:15
Hello, I'm trying to figure out how to obtain the public key used to encrypt the Git file downloads. I put together a gist that explains the problem and question in detail here: https://gist.github.com/bkuhlmann/684b74d25d83d52df8d0caeb6219aa15 If anyone has any advice on how to make this possible, it would be greatly appreciated. Thanks, Brooke
From: Jason Pyeron <hidden>
Date: 2021-01-24 17:58:12
From: Brooke Kuhlmann Sent: Sunday, January 24, 2021 11:49 AM Hello, I'm trying to figure out how to obtain the public key used to encrypt
Do you mean sign?
the Git file downloads. I put together a gist that explains the problem and question in detail here: https://gist.github.com/bkuhlmann/684b74d25d83d52df8d0caeb6219aa15
Please don’t post links to questions, pasting your content inline here:
Problem When attempting to download a Git version, it would be nice to verify the signature of the download by running the following: curl --remote-name https://mirrors.edge.kernel.org/pub/software/scm/git/git-2.30.0.tar.gz curl --remote-name https://mirrors.edge.kernel.org/pub/software/scm/git/git-2.30.0.tar.sign gpg --verify git-2.30.0.tar.sign git-2.30.0.tar.gz Only problem is that the last line of the above throws the following error: gpg: Signature made Sun Dec 27 23:12:30 2020 MST gpg: using RSA key E1F036B1FEE7221FC778ECEFB0B5E88696AFE6CB gpg: Can't check signature: No public key I tried using the following solutions to no avail:
$ gpg --recv-keys 96AFE6CB gpg: requesting key 96AFE6CB from hkp server keys.gnupg.net gpg: key 713660A7: "Junio C Hamano [off-list ref]" 59 new signatures gpg: key 713660A7: "Junio C Hamano [off-list ref]" 2 new subkeys gpg: no ultimately trusted keys found gpg: Total number processed: 1 gpg: new subkeys: 2 gpg: new signatures: 59 $ gpg --verify -v git-2.30.0.tar.sign git-2.30.0.tar.gz gpg: Signature made Mon Dec 28 01:12:30 2020 EST using RSA key ID 96AFE6CB gpg: NOTE: signature key 96AFE6CB expired Sun Jul 26 13:41:24 2020 EDT gpg: NOTE: signature key B3F7CAC9 expired Sun Jul 26 13:41:42 2020 EDT gpg: using subkey 96AFE6CB instead of primary key 713660A7 gpg: NOTE: signature key 96AFE6CB expired Sun Jul 26 13:41:24 2020 EDT gpg: NOTE: signature key 96AFE6CB expired Sun Jul 26 13:41:24 2020 EDT gpg: NOTE: signature key B3F7CAC9 expired Sun Jul 26 13:41:42 2020 EDT gpg: using PGP trust model gpg: BAD signature from "Junio C Hamano [off-list ref]" gpg: binary signature, digest algorithm SHA256 $ gpg --list-keys -v 96AFE6CB gpg: using PGP trust model gpg: NOTE: signature key 96AFE6CB expired Sun Jul 26 13:41:24 2020 EDT gpg: NOTE: signature key B3F7CAC9 expired Sun Jul 26 13:41:42 2020 EDT pub 4096R/713660A7 2011-10-01 uid Junio C Hamano [off-list ref] uid Junio C Hamano [off-list ref] uid Junio C Hamano [off-list ref] sub 4096R/96AFE6CB 2011-10-03 [expired: 2020-07-26] sub 4096R/833262C4 2011-10-01 sub 4096R/B3F7CAC9 2014-09-20 [expired: 2020-07-26] It is possible that Junio forgot to push his refreshed public key.
gpg --locate-keys torvalds@kernel.org gregkh@kernel.org committer@example.com discord@example.net gitster@pobox.com gpg --import <file> # <= Need a file to import but where does one obtain the public key? I also tried importing only the public keys from the Git repository via the following files without any luck either: t/lib-gpg/keyring.gpg contrib/credential/netrc/test.git-config-gpg contrib/credential/netrc/test.netrc.gpg contrib/credential/netrc/test.command-option-gpg Question How does one figure out how to obtain the public keys for which the Git downloads were signed? If anyone has any advice on how to make this possible, it would be greatly appreciated. Thanks, Brooke
From: brian m. carlson <hidden>
Date: 2021-01-24 21:34:55
On 2021-01-24 at 17:57:13, Jason Pyeron wrote:
$ gpg --recv-keys 96AFE6CB gpg: requesting key 96AFE6CB from hkp server keys.gnupg.net gpg: key 713660A7: "Junio C Hamano [off-list ref]" 59 new signatures gpg: key 713660A7: "Junio C Hamano [off-list ref]" 2 new subkeys gpg: no ultimately trusted keys found gpg: Total number processed: 1 gpg: new subkeys: 2 gpg: new signatures: 59 $ gpg --verify -v git-2.30.0.tar.sign git-2.30.0.tar.gz gpg: Signature made Mon Dec 28 01:12:30 2020 EST using RSA key ID 96AFE6CB gpg: NOTE: signature key 96AFE6CB expired Sun Jul 26 13:41:24 2020 EDT gpg: NOTE: signature key B3F7CAC9 expired Sun Jul 26 13:41:42 2020 EDT gpg: using subkey 96AFE6CB instead of primary key 713660A7 gpg: NOTE: signature key 96AFE6CB expired Sun Jul 26 13:41:24 2020 EDT gpg: NOTE: signature key 96AFE6CB expired Sun Jul 26 13:41:24 2020 EDT gpg: NOTE: signature key B3F7CAC9 expired Sun Jul 26 13:41:42 2020 EDT gpg: using PGP trust model gpg: BAD signature from "Junio C Hamano [off-list ref]" gpg: binary signature, digest algorithm SHA256
The signature is bad because it's over the uncompressed .tar, not the .tar.gz. There is also a .tar.xz and the signature is the same. You therefore need to uncompress it first with gunzip.
$ gpg --list-keys -v 96AFE6CB gpg: using PGP trust model gpg: NOTE: signature key 96AFE6CB expired Sun Jul 26 13:41:24 2020 EDT gpg: NOTE: signature key B3F7CAC9 expired Sun Jul 26 13:41:42 2020 EDT pub 4096R/713660A7 2011-10-01 uid Junio C Hamano [off-list ref] uid Junio C Hamano [off-list ref] uid Junio C Hamano [off-list ref] sub 4096R/96AFE6CB 2011-10-03 [expired: 2020-07-26] sub 4096R/833262C4 2011-10-01 sub 4096R/B3F7CAC9 2014-09-20 [expired: 2020-07-26] It is possible that Junio forgot to push his refreshed public key.
Yes, I think that's the case. -- brian m. carlson (he/him or they/them) Houston, Texas, US
From: Jason Pyeron <hidden>
Date: 2021-01-24 22:25:40
From: brian m. carlson Sent: Sunday, January 24, 2021 4:34 PM On 2021-01-24 at 17:57:13, Jason Pyeron wrote:quoted
$ gpg --recv-keys 96AFE6CB gpg: requesting key 96AFE6CB from hkp server keys.gnupg.net gpg: key 713660A7: "Junio C Hamano [off-list ref]" 59 new signatures gpg: key 713660A7: "Junio C Hamano [off-list ref]" 2 new subkeys gpg: no ultimately trusted keys found gpg: Total number processed: 1 gpg: new subkeys: 2 gpg: new signatures: 59 $ gpg --verify -v git-2.30.0.tar.sign git-2.30.0.tar.gz gpg: Signature made Mon Dec 28 01:12:30 2020 EST using RSA key ID 96AFE6CB gpg: NOTE: signature key 96AFE6CB expired Sun Jul 26 13:41:24 2020 EDT gpg: NOTE: signature key B3F7CAC9 expired Sun Jul 26 13:41:42 2020 EDT gpg: using subkey 96AFE6CB instead of primary key 713660A7 gpg: NOTE: signature key 96AFE6CB expired Sun Jul 26 13:41:24 2020 EDT gpg: NOTE: signature key 96AFE6CB expired Sun Jul 26 13:41:24 2020 EDT gpg: NOTE: signature key B3F7CAC9 expired Sun Jul 26 13:41:42 2020 EDT gpg: using PGP trust model gpg: BAD signature from "Junio C Hamano [off-list ref]" gpg: binary signature, digest algorithm SHA256The signature is bad because it's over the uncompressed .tar, not the .tar.gz. There is also a .tar.xz and the signature is the same. You therefore need to uncompress it first with gunzip.
Silly me, but maybe there should be a README in that directory, along with the signatures.asc. If not, then it should easily be found on the git-scm site.
$ gpg --verify git-2.30.0.tar.sign git-2.30.0.tar
gpg: Signature made Mon Dec 28 01:12:30 2020 EST using RSA key ID 96AFE6CB
gpg: Good signature from "Junio C Hamano [off-list ref]"
gpg: aka "Junio C Hamano [off-list ref]"
gpg: aka "Junio C Hamano [off-list ref]"
gpg: Note: This key has expired!
Primary key fingerprint: 96E0 7AF2 5771 9559 80DA D100 20D0 4E5A 7136 60A7
Subkey fingerprint: E1F0 36B1 FEE7 221F C778 ECEF B0B5 E886 96AF E6CB
quoted
$ gpg --list-keys -v 96AFE6CB gpg: using PGP trust model gpg: NOTE: signature key 96AFE6CB expired Sun Jul 26 13:41:24 2020 EDT gpg: NOTE: signature key B3F7CAC9 expired Sun Jul 26 13:41:42 2020 EDT pub 4096R/713660A7 2011-10-01 uid Junio C Hamano [off-list ref] uid Junio C Hamano [off-list ref] uid Junio C Hamano [off-list ref] sub 4096R/96AFE6CB 2011-10-03 [expired: 2020-07-26] sub 4096R/833262C4 2011-10-01 sub 4096R/B3F7CAC9 2014-09-20 [expired: 2020-07-26] It is possible that Junio forgot to push his refreshed public key.Yes, I think that's the case.