I have to download a program with a PGP signature and a signing key (Public Key)

How do I check the program with signing key?


Assuming you have GPG installed:

gpg --import signing_key.pub
gpg --verify signed_file.sig

Where signing_key.pub is the public key, and signed_file.sig is the detached signature for the file (in the same directory as the signed file).

  • first thanks for you answer! , i have to do as you to say . and i come; gpg key: key ........... gpg sig: RSA.................... but i not understand how working together..........every one have different cipher.... how know the program i dowloaded is it .....so , i have download the Tcpdum from here tcpdump.org/#latest-release and i will know if it is the genuine Tcpdump.... – 567hz Mar 7 '18 at 17:22
  • so how i have understand... with signing_key , i come : E089DEF1D9C15D0D with signed_key : 1F166A5742ABB9E0249A8D30 is here the RSA key? E089DEF1D9C15D0D und here is my signing_key! . Together the RSA key: 1F166A5742ABB9E0249A8D30E089DEF1D9C15D0D – 567hz Mar 7 '18 at 17:38
  • For verifying the File's Signature : gpg --verify tcpdump-4.9.2.tar.gz.sig tcpdump-4.9.2.tar.gz gnupg.org/download/integrity_check.html – 567hz Mar 8 '18 at 13:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.