From the log4j download page.

The PGP signatures can be verified using PGP or GPG. First download the KEYS as well as the asc signature file for the relevant distribution. Make sure you get these files from the main distribution directory, rather than from a mirror. Then verify the signatures using

% gpg --import KEYS

% gpg --verify log4j-1.2.17.tar.gz.asc

My questions are:

  1. Which portion of 'KEYS' webpage do I need to download ? Should -----BEGIN PGP PUBLIC KEY BLOCK----- and ----END PGP PUBLIC KEY BLOCK----- be included in the key signed by Christian Grobmeier ?

  2. What does KEYs in gpg --import KEYS mean? Is 'KEYS' a file on the local desktop? If yes which format? txt?


1 Answer 1


To the second question, the KEYS is the file that is linked on the apache site. You just have to download it as is (and by as is I mean, with all the comments and the --BEGIN --END shenanigans). Just right click the link and save it like this.

To the second question, the gpg --import command will sort out what is a key and what is not, importing all the keys in bulk.

  • 1
    interesting, thanks a ton. What format should KEYS be in ? Sep 14, 2015 at 14:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.