From the log4j download page.
The PGP signatures can be verified using PGP or GPG. First download the KEYS as well as the asc signature file for the relevant distribution. Make sure you get these files from the main distribution directory, rather than from a mirror. Then verify the signatures using
% gpg --import KEYS
% gpg --verify log4j-1.2.17.tar.gz.asc
My questions are:
Which portion of 'KEYS' webpage do I need to download ? Should
-----BEGIN PGP PUBLIC KEY BLOCK-----and
----END PGP PUBLIC KEY BLOCK-----be included in the key signed by Christian Grobmeier ?
What does KEYs in
gpg --import KEYSmean? Is 'KEYS' a file on the local desktop? If yes which format? txt?