3

I have a file which I have signed with two GPG keys and want to validate that file trough a script. The scripts validates that the signatures are correct by checking the returned status from GPG. If its not zero, the check fails.

The problem is that the machine where I'm running the script on only has one of the keys (and adding the second key to that machine is unfortunately not an solution in this case). So since I don't have both the keys, the validation fails or 2 is returned from GPG.

My question is: Is there some switch that I can give GPG so that I only need one of the public keys on the machine (one or the other) to pass the validation? GPG must of course be able to at least verify one of the keys but not necessary both of them.

Improve this question

1 Answer 1

Reset to default
3

Sign the file two times with detached signature and move the signature files to file.sig1 and file.sig2. When verifying, move the one you have the key for back to file.sig.

If you do not know which one should match, test both, i.e. gpg --verify test1.sig || gpg --verify test2.sig.

Improve this answer
1
  • Looks promising and I will try it and see if it can be applied to my situation. Thank you for your answer.
    – Fever
    Apr 18, 2018 at 10:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .