2

I have a file which I have signed with two GPG keys and want to validate that file trough a script. The scripts validates that the signatures are correct by checking the returned status from GPG. If its not zero, the check fails.

The problem is that the machine where I'm running the script on only has one of the keys (and adding the second key to that machine is unfortunately not an solution in this case). So since I don't have both the keys, the validation fails or 2 is returned from GPG.

My question is: Is there some switch that I can give GPG so that I only need one of the public keys on the machine (one or the other) to pass the validation? GPG must of course be able to at least verify one of the keys but not necessary both of them.

3

Sign the file two times with detached signature and move the signature files to file.sig1 and file.sig2. When verifying, move the one you have the key for back to file.sig.

If you do not know which one should match, test both, i.e. gpg --verify test1.sig || gpg --verify test2.sig.

  • Looks promising and I will try it and see if it can be applied to my situation. Thank you for your answer. – Fever Apr 18 '18 at 10:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.