Timeline for How to verify the authenticity of a download?
Current License: CC BY-SA 3.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 21, 2017 at 6:14 | comment | added | Snger | inport -> import | |
| Sep 5, 2016 at 14:29 | comment | added | Yorick de Wid | @billc.cn Yes, GPG always does that when you import a key that hasn't signed your key. In this case there is no need for that, because the laanwj-releases.asc already came over a secure channel. Besides, if the key were to be fake, we would have expected it to be revoked by now. | |
| Sep 5, 2016 at 14:26 | comment | added | billc.cn |
I think it is now good if you trust the authenticity of laanwj-releases.asc. The warning means the key used to generate the signature does not have enough trust level, but the signature is nontheless good.
|
|
| Sep 4, 2016 at 14:21 | comment | added | oshirowanen | @billc.cn, please see update 3. | |
| Sep 4, 2016 at 14:21 | comment | added | oshirowanen | @YorickdeWid, please see update 3. | |
| Aug 31, 2016 at 14:36 | comment | added | Yorick de Wid | @billc.cn thx, updated the post | |
| Aug 31, 2016 at 14:36 | history | edited | Yorick de Wid | CC BY-SA 3.0 |
added 216 characters in body
|
| Aug 31, 2016 at 14:13 | comment | added | billc.cn |
I'd say step 0 is to verify you got laanwj-releases.asc from a trusted source and via trusted means. (For example, I was quite shocked when Ubuntu only allow you to download their key via HTTP....)
|
|
| Aug 31, 2016 at 9:41 | history | answered | Yorick de Wid | CC BY-SA 3.0 |