[Sorry, this got auto-dropped from the moderation queue. You may not see replies without being subscribed.]
Neil Baker <[email protected]> writes: > Hi Dave, > > I totally agree with you that if someone hacked into the repository, that > they could also create new MD5s. As a result I'm trying the .sig files. > > I've been trying to verify the source code with gpg, but my lack of gpg > skills seems to be a problem. With RPM, which I thought you were using, signatures are built in, but you need to import the key before doing something like rpm --verify --checksig --nofiles ... or using yum. See the man pages or, I guess, Red Hat documentation. > Here is an example: > # gpg --verify arco-8.1.6.tar.gz.sig arco-8.1.6.tar.gz > gpg: Signature made Sun 13 Oct 2013 21:17:47 GMT using RSA key ID B5AEEEA9 > gpg: Can't check signature: No public key > > If I try and receive the key B5AEEEA9 it times out: > # gpg --recv-keys B5AEEEA9 > gpg: requesting key B5AEEEA9 from hkp server keys.gnupg.net > gpg: keyserver timed out > gpg: keyserver receive failed: Keyserver error That works for me currently. > I get the same error if I specify arc.liv.ac.uk as the key server. It doesn't run a keyserver. > # gpg --keyserver arc.liv.ac.uk --recv-keys B5AEEEA9 > gpg: requesting key B5AEEEA9 from hkp server arc.liv.ac.uk > gpg: keyserver timed out > gpg: keyserver receive failed: Keyserver error > > This is the first time I have run gpg, so I don't know if I'm supposed to > create my own public / private keys first? No. > I'm sure I'm making a simple mistake, but I've tried to Google for possible > solutions to these gpg problems without success. > > Do you have an example command that I can use to verify these files. The gpg --verify line is correct, but requires you to have downloaded the key. I'm puzzled why SGE packages are different from anything else you install in this regard. If you don't have signature checks for repositories you use, you should turn them on -- especially with auto updates. _______________________________________________ SGE-discuss mailing list [email protected] https://arc.liv.ac.uk/mailman/listinfo/sge-discuss
