由于缺少公钥,使用 rvm 安装 ruby​​s 时出现问题

bje*_*lli 8 cryptography gnupg rvm

昨天我尝试在 Ubuntu 上安装 ruby​​ 或更新 rvm,今天在 mac os 上,但我在两个地方都失败了:

$ rvm get head
Downloading https://get.rvm.io
Downloading https://raw.githubusercontent.com/rvm/rvm/master/binscripts/rvm-installer.asc
Verifying /Users/bjelline/.rvm/archives/rvm-installer.asc
gpg: Signature made Sun Dec 30 11:44:46 2018 CET using RSA key ID 39499BDB
gpg: Can't check signature: No public key
Warning, RVM 1.26.0 introduces signed releases and automated check of signatures when GPG software found. Assuming you trust Michal Papis import the mpapis public key (downloading the signatures).

GPG signature verification failed for '/Users/bjelline/.rvm/archives/rvm-installer' - 'https://raw.githubusercontent.com/rvm/rvm/master/binscripts/rvm-installer.asc'! Try to install GPG v2 and then fetch the public key:

    gpg2 --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3

or if it fails:

    command curl -sSL https://rvm.io/mpapis.asc | gpg2 --import -

the key can be compared with:

    https://rvm.io/mpapis.asc
    https://keybase.io/mpapis

NOTE: GPG version 2.1.17 have a bug which cause failures during fetching keys from remote server. Please downgrade or upgrade to newer version (if available) or use the second method described above.

-bash: return: _ret: numeric argument required
Run Code Online (Sandbox Code Playgroud)

我已经尝试了两种获取提到的公钥的版本:使用 curl:

$ command curl -sSL https://rvm.io/mpapis.asc | gpg2 --import -
gpg: key D39DC0E3: "Michal Papis (RVM signing) <mpapis@gmail.com>" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1
Run Code Online (Sandbox Code Playgroud)

并且还使用 pgp2 --recv-keys:

$ gpg2 --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3
gpg: requesting key D39DC0E3 from hkp server keys.gnupg.net
gpg: key D39DC0E3: "Michal Papis (RVM signing) <mpapis@gmail.com>" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1
Run Code Online (Sandbox Code Playgroud)

请注意两者如何提及密钥 D39DC0E3 ...未更改

那么,D39DC0E3 有什么问题吗?我怎么知道?

或者它只是错误的键?在rvm get head的输出中,我找到了链接

gpg: Signature made Sun Dec 30 11:44:46 2018 CET using RSA key ID 39499BDB
gpg: Can't check signature: No public key
Run Code Online (Sandbox Code Playgroud)

是RSA密钥ID 39499BDB一样 关键D39DC0E3?我怎么知道?

bje*_*lli 12

github上有一个问题解释了这一点:

https://github.com/rvm/rvm/issues/4520

似乎是错误提醒我rvm的维护者已经改变的事实:新的维护者github.com/pkuczynski使用另一个密钥进行签名。

我要信任这个新的维护者吗?然后我可以添加他的密钥:

gpg --keyserver hkp://keys.gnupg.net --recv-keys 7D2BAF1CF37B13E2069D6956105BD0E739499BDB
Run Code Online (Sandbox Code Playgroud)