我在哪里可以找到Gnu Emacs的公钥？

Question

从23.1到23.3,我只使用了emacs半年.

每次我试图找到emacs的gpg公钥,以便我可以检查tar.gz包,每个新版本都发布tar.gz.sig.结果我每次都失败了: - ].

看来我应该首先获取公钥,然后我搜索了emacs的网站,但从未找到任何标志......

我只能在邮件列表http://lists.gnu.org/archive/html/info-gnu-emacs/2011-03/msg00000.html中找到SHA1校验和 来进行完整性检查

顺便说一下,我不怀疑FSF的安全性.只是好奇......从来没有使用过gpg ......

你能给我一个链接吗？

谢谢

Answer 1

如果您尝试使用验证签名

gpg --verify <pkg>.key

你会得到如下输出:

gpg: Signature made 02/17/05 14:02:42 GTB Standard Time using DSA key ID BE216115
gpg: Can't check signature: No public key

您正在寻找的密钥ID是BE216115,因此您要求gpg使用以下方法检索它:

gpg --recv-keys BE216115

这导致我的安装如下:

gpg: requesting key BE216115 from hkp server keys.gnupg.net
gpg: key BE216115: public key "Francesco Potortì <pot@potorti.it>" imported
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0  valid:   1  signed:   1  trust: 0-, 0q, 0n, 0m, 0f, 1u
gpg: depth: 1  valid:   1  signed:   6  trust: 0-, 0q, 0n, 0m, 1f, 0u
gpg: depth: 2  valid:   6  signed:   1  trust: 0-, 0q, 0n, 6m, 0f, 0u
gpg: Total number processed: 1
gpg:               imported: 1

现在,您可以验证它.但由于您尚未对此密钥分配任何信任,因此输出将为:

gpg: Signature made 02/17/05 14:02:42 GTB Standard Time using DSA key ID BE216115
gpg: Good signature from "Francesco Potortì <pot@potorti.it>"
gpg:                 aka "Francesco Potortì <pot@gnu.org>"
gpg:                 aka "Francesco Potortì <Potorti@isti.cnr.it>"
gpg:                 aka "Francesco Potortì <pot@softwarelibero.it>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 4B02 6187 5C03 D6B1 2E31  7666 09DF 2DC9 BE21 6115

因此,您将知道签名有效,但您不信任公钥.您可以使用以下方式信任或签署公钥:

gpg --edit-key BE216115

在命令提示符下键入help以查看所有可用选项.有关详细信息,请参阅使用GNU Privacy Guard

Answer 2

GNU密钥环位于/anonymous@ftp.gnu.org:/gnu/gnu-keyring.gpg

您可以在本地导入(下载后)

gpg --import gnu-keyring.gpg

Answer 3

@vhallac的答案现已过时(我正在尝试验证emacs-24.4下载).如果您不想下载并导入整个GNU密钥环(如@JSON所讨论的那样),这是一种完成此操作的方法.在这个答案中,我将展示今天有效的方法,以及如何弄清楚从现在起一年后会有什么用.

首先下载emacs及其.sig文件.我有:

$ ls | grep emacs
emacs-24.4.tar.xz
emacs-24.4.tar.xz.sig

假设您已经安装了gpg,请尝试验证它:

$ gpg --verify emacs-24.4.tar.xz.sig 
gpg: Signature made Mon 20 Oct 2014 02:58:21 PM EDT using RSA key ID A0B0F199
gpg: Can't check signature: public key not found

在这次尝试中,它失败了(你会在这篇文章的最后看到一次成功的尝试).我没有公钥.输出告诉您需要获取哪个公钥: A0B0F199.(这是将来最有可能改变的事情.)

然后我尝试使用默认命令下载它:

$ gpg --recv-keys A0B0F199
gpg: requesting key A0B0F199 from hkp server keys.gnupg.net
(...hangs here...)

它只是挂起.那是因为我ufw(我的Linux防火墙软件)阻止了大多数端口.您可以告诉gpg使用端口80,如下所示:

$ gpg --keyserver hkp://keys.gnupg.net:80 --recv-keys A0B0F199
gpg: requesting key A0B0F199 from hkp server keys.gnupg.net
gpgkeys: key A0B0F199 not found on keyserver
gpg: no valid OpenPGP data found.
gpg: Total number processed: 0

它通过防火墙,但失败了,因为由于某种原因,Emacs/FSF密钥不再存储在gnupg服务器上.所以我尝试了我所知道的另一个密钥服务器,并且有一定程度的信任:

$ gpg --keyserver hkp://pool.sks-keyservers.net:80 --recv-keys A0B0F199
gpg: requesting key A0B0F199 from hkp server pool.sks-keyservers.net
gpg: key A0B0F199: public key "Glenn Morris <rgm@gnu.org>" imported
gpg: Total number processed: 1
gpg:               imported: 1  (RSA: 1)

好的,它奏效了.现在检查一下:

$ gpg --list-keys
...
pub   2048R/A0B0F199 2012-12-23 [expires: 2015-12-23]
uid                  Glenn Morris <rgm@gnu.org>
sub   2048R/951C59EC 2012-12-23 [expires: 2015-12-23]

明白了,明白了.

现在我可以验证下载的emacs tarball:

$ gpg --verify emacs-24.4.tar.xz.sig 
gpg: Signature made Mon 20 Oct 2014 02:58:21 PM EDT using RSA key ID A0B0F199
gpg: Good signature from "Glenn Morris <rgm@gnu.org>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: B294 26DE FB07 724C 3C35  E5D3 6592 E9A3 A0B0 F199

签名是"好的",但不受信任.请参阅其他答案,了解如何信任该密钥.

Answer 4

READMEGNU FTP服务器的根级别有一个文件,它解释了如何使用签名.

请参阅ftp://ftp.gnu.org/README以获取最新版本.

当前文件说:

There are also .sig files, which contain detached GPG signatures of the above
files, automatically signed by the same script that generates them.

You can verify the signatures for gnu project files with the keyring file from:
  https://ftp.gnu.org/gnu/gnu-keyring.gpg

In a directory with the keyring file, the source file to verify and the
signature file, the command to use is:

  $ gpg --verify --keyring ./gnu-keyring.gpg foo.tar.xz.sig