6

If I want to verify a the signatures on a project whose packages I download & verify frequently, would it be reasonable to for me to sign that project's signing key?

Currently, I verify the signature using GPG, I then have to manually check the signature fingerprint against the fingerprint published online. Is this a correct use case for signing a key? I have no friends in the web of trust through which I can trust these keys.

Of course, I've never met anyone in person to verify the key, but I've verified several signatures of the same key over a period of a couple of weeks. I think I can be reasonably certain that the signing key is theirs.

Improve this question

2 Answers 2

Reset to default
5

If you trust your projects downloads and their signature, you can reflect this trust by signing the project's PGP key. So, later you'll know that you trusted this key.

If, however, you're not sure that you trust this project key, don't sign it.

Whether you trust the project's key or not is your choice alone. Using PGP is just a way to keep a trace of your trust.

Improve this answer
4

If you are not sharing the key with anyone, the signature is purely for your convenience and amusement. I have a gpg profile specifically for verifying project signatures, and I do sign the project keys that I download. Applying appropriate trust levels based on how you obtained the keys is also likely prudent.

Your friends might be interested in reusing the work you have done, and you could even share your signed project keys with the disclaimer of how you got them!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .