How can I verify the GPG signature is valid?

Question

I'm trying to figure out if there is a way to be 100% sure that a GPG signature is valid. I'm not entirely sure how it all works, or the correct terminology, so forgive any lack of understanding. I was trying to understand chain of trust, how can you guarantee that any signature you receive is not modified? Take downloading Tor browser, for example. I guess it depends on how paranoid one is. If it is assumed, for example, that Google is collaborating with the local government, and there is a regex in Chrome's binary that modifies each instance of the signature or key fingerprint to match the one that goes with the modified Tor browser, would the whole process be compromised? Or if the signature-validating software has been modified, or whatever other hypothetical challenges could be conceived.

tl;dr

What would be the minimum reasonable assumptions you would have to make about the environment/process in order to be as confident as possible that a signature and the content it signed is valid and unmodified (short of meeting the developer in person and exchanging key fingerprints)?

Answer 1

I'm not entirely sure how it all works, or the correct terminology,

The correct terminology is called verification.

I guess it depends on how paranoid one is.

Yes, absolutely. There is no technical solution to these kind of problems. If you are paranoid enough, you wouldn't even trust your computer at all, because it could have been fiddled with before you purchased it.

What would be the minimum reasonable assumptions you would have to make about the environment/process in order to be as confident as possible that a signature and the content it signed is valid and unmodified (short of meeting the developer in person and exchanging key fingerprints)?

You probably want to take a look at the warning page of Tails, which gives a pretty good overview of possible attacks. There is also a section dedicated to the process of verification guiding you through the process step-by-step

Personally, I would argue that it depends pretty much on what you are up to. For most of us, it should be good enough to use secure connection (e.g. SSL/TLS) and compare the downloaded version against some sort of simple hash. This rules out errors during the transmission of any file and really sloppy attempts to get you infected. Signatures are fine, too, but they make only sense if you make sure that the keys being involved match up to your expectation, which sound easy in theory, but turns out to be quite hard in practice.

If you are really not sure as to whether your computer is trustworthy, it would probably be a good idea to get a second opinion in form of another computer. Ideally, this computer would be completely independent of the first one, so it would be hard for an attacker to get both under his control.

(short of meeting the developer in person and exchanging key fingerprints)?

GPG in its normal mode of operation relies on a web of trust, which is quite a good model, but obviously is not perfectly secure. The beauty of it is that you not necessarily need to meet the developer itself, but only need to know someone who knows someone, who knows the developer. You can use this chain of trust to verify the authenticity of any signature.

I'm trying to figure out if there is a way to be 100% sure that a GPG signature is valid.

You won't get this 100% figure in practice. It is always a possibility that someone got hold of the private key. He then could sign whatever the heck he wants to.

Answer 2

The most secure way is to verify either the short ID (B6C1D744) or the fingerprint (3DAB 6056 975A 4275 5724 C83D 34DD 35E1 C8C6 B812) with the key owner... paranoid people will do this in person, less paranoid by phone, and even less paranoid (and less secure for hopefully obvious reasons) by email.