From 74a3058abc8b0f39198ceb488e91ae4329c1046e Mon Sep 17 00:00:00 2001 From: Michael Gajda Date: Fri, 2 Mar 2018 18:23:34 +0100 Subject: [PATCH] Add docs on how to verify a signed release Short howto on using gpg to verify a signed binary release. Fixes #3634 --- docs/support.rst | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) diff --git a/docs/support.rst b/docs/support.rst index 0e583dbea..d3141ebcd 100644 --- a/docs/support.rst +++ b/docs/support.rst @@ -24,5 +24,31 @@ GPG Key Fingerprint: 6D5B EF9A DD20 7580 5747 B70F 9F88 FB52 FAF7 B393 The public key can be fetched from any GPG keyserver, but be careful: you must use the **full fingerprint** to check that you got the correct key. -`Releases `_ are signed with this GPG key, -please use GPG to verify their authenticity. +Verifying signed releases +------------------------- + +`Releases `_ are signed with the same GPG key and a .asc file is provided for each binary. + +To verify a signature, the public key needs to be known to GPG. It can be imported into the local keystore from a keyserver with the fingerprint: + + gpg --recv-keys "6D5B EF9A DD20 7580 5747 B70F 9F88 FB52 FAF7 B393" + +If GPG successfully imported the key, the output should be (among other things): 'Total number processed: 1'. + +To verify for example the signature of the borg-linux64 binary: + + gpg --verify borg-linux64.asc + +GPG outputs if it finds a good signature. The output should look similar to this: + + gpg: Signature made Sat 30 Dec 2017 01:07:36 PM CET using RSA key ID 51F78E01 + gpg: Good signature from "Thomas Waldmann " + gpg: aka "Thomas Waldmann " + gpg: aka "Thomas Waldmann " + gpg: aka "Thomas Waldmann " + gpg: WARNING: This key is not certified with a trusted signature! + gpg: There is no indication that the signature belongs to the owner. + Primary key fingerprint: 6D5B EF9A DD20 7580 5747 B70F 9F88 FB52 FAF7 B393 + Subkey fingerprint: 2F81 AFFB AB04 E11F E8EE 65D4 243A CFA9 51F7 8E01 + +If you want to make absolutely sure that you have the right key, you need to verify it via another channel and assign a trust-level to it. \ No newline at end of file