0

From the log4j download page.

The PGP signatures can be verified using PGP or GPG. First download the KEYS as well as the asc signature file for the relevant distribution. Make sure you get these files from the main distribution directory, rather than from a mirror. Then verify the signatures using

% gpg --import KEYS

% gpg --verify log4j-1.2.17.tar.gz.asc

My questions are:

  1. Which portion of 'KEYS' webpage do I need to download ? Should -----BEGIN PGP PUBLIC KEY BLOCK----- and ----END PGP PUBLIC KEY BLOCK----- be included in the key signed by Christian Grobmeier ?

  2. What does KEYs in gpg --import KEYS mean? Is 'KEYS' a file on the local desktop? If yes which format? txt?

Improve this question
1

1 Answer 1

Reset to default
1

To the second question, the KEYS is the file that is linked on the apache site. You just have to download it as is (and by as is I mean, with all the comments and the --BEGIN --END shenanigans). Just right click the link and save it like this.

To the second question, the gpg --import command will sort out what is a key and what is not, importing all the keys in bulk.

Improve this answer
1
  • 1
    interesting, thanks a ton. What format should KEYS be in ?
    – JavaDeveloper
    Commented Sep 14, 2015 at 14:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .