4

If I sign a file right now a check the .gpg file that's generated it will output a timestamp, is it possible to change the time when signing the file?

➜  Downloads gpg --verify cache.html.gpg 
gpg: Signature made Thu  9 Mar 14:27:07 2017 ACDT using RSA key ID A4DB4615
gpg: Good signature from "Tyler Bridger <[email protected]>" [ultimate]
gpg:                 aka "keybase.io/omgimalexis <[email protected]>" [ultimate]
Improve this question

1 Answer 1

Reset to default
4

Yes, there's multiple ways you can do it:

  • Change the system time, sign the file, then put the time back
  • Run gpg inside datefudge or faketime
  • Use gpg's --faked-system-time option

Because of these possibilities, you can only trust the timestamp on a signature if you trust the signer to not have faked it.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .