3

I downloaded the Putty installer from ssh.com, which said

To import the signature key into GPG, use:

gpg --import putty-release-2015.asc

To check the signature of a file, use:

gpg --verify <signaturefile> <datafile>

For example:

gpg --verify putty-64bit-0.70-installer.msi.gpg putty-64bit-0.70-installer.msi

Running the first example command worked fine. I used gpg --list-keys to verify that I have the release key from Putty's website.

The second example command gets me 

gpg: can't open `putty-64bit-0.70-installer.msi.gpg': No such file or directory

I looked at the signature verification manual from GnuPG, but unless I am supposed to find a detached signature, I don't see where that .gpg file is supposed to come from.

Improve this question
4
  • Well, download the .gpg file from here. It's right next to the binary download link.
    – Arminius
    Commented Sep 2, 2017 at 1:09
  • @Arminius Where did you get the link? I had looked at chiark.greenend.org.uk/~sgtatham/putty/keys.html
    – Noumenon
    Commented Sep 2, 2017 at 1:11
  • 1
    Right from where you downloaded it. It's really hard to miss. :)
    – Arminius
    Commented Sep 2, 2017 at 1:12
  • Thanks, it worked. It was easy to miss because when you go to download something, you purposely tune out all other links but the one you want. Then in the section about how to verify, it's off the screen two headings up. I didn't have the mental model of "signature separate thing from signature key, must be provided as a file". While skimming, I read "signature" as though it meant a characteristic "fingerprint" or something trivial.
    – Noumenon
    Commented Sep 2, 2017 at 1:15

1 Answer 1

Reset to default
3

The signature file contains the signature made by the software author's OpenPGP key on the application and thus proves authorship (given you also validated the key belongs to whom it should belong to). There is not really any use in creating your own: the signature would prove you signed the application, but this does not help at making sure nobody tampered with the software you downloaded. If you'd be able to create a valid signature in the author's name on your own, the whole process of digital signing would be forfeit.

Instead, look for the original signature, which is provided right next to the software download.

Putty signature download source

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .