3

I downloaded the Putty installer from ssh.com, which said

To import the signature key into GPG, use:

gpg --import putty-release-2015.asc

To check the signature of a file, use:

gpg --verify <signaturefile> <datafile>

For example:

gpg --verify putty-64bit-0.70-installer.msi.gpg putty-64bit-0.70-installer.msi

Running the first example command worked fine. I used gpg --list-keys to verify that I have the release key from Putty's website.

The second example command gets me

gpg: can't open `putty-64bit-0.70-installer.msi.gpg': No such file or directory

I looked at the signature verification manual from GnuPG, but unless I am supposed to find a detached signature, I don't see where that .gpg file is supposed to come from.

  • Well, download the .gpg file from here. It's right next to the binary download link. – Arminius Sep 2 '17 at 1:09
  • @Arminius Where did you get the link? I had looked at chiark.greenend.org.uk/~sgtatham/putty/keys.html – Noumenon Sep 2 '17 at 1:11
  • 1
    Right from where you downloaded it. It's really hard to miss. :) – Arminius Sep 2 '17 at 1:12
  • Thanks, it worked. It was easy to miss because when you go to download something, you purposely tune out all other links but the one you want. Then in the section about how to verify, it's off the screen two headings up. I didn't have the mental model of "signature separate thing from signature key, must be provided as a file". While skimming, I read "signature" as though it meant a characteristic "fingerprint" or something trivial. – Noumenon Sep 2 '17 at 1:15
3

The signature file contains the signature made by the software author's OpenPGP key on the application and thus proves authorship (given you also validated the key belongs to whom it should belong to). There is not really any use in creating your own: the signature would prove you signed the application, but this does not help at making sure nobody tampered with the software you downloaded. If you'd be able to create a valid signature in the author's name on your own, the whole process of digital signing would be forfeit.

Instead, look for the original signature, which is provided right next to the software download.

Putty signature download source

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.