The Funtoo Linux project has transitioned to "Hobby Mode" and this wiki is now read-only.
Difference between revisions of "GPG Signatures"
m |
|||
| Line 16: | Line 16: | ||
{{TableEnd}} | {{TableEnd}} | ||
To verify the integrity of stage3 tarballs using GPG, first download your preferred stage3 taball, and the matching file with the additional {{c|.gpg}} extension in the same directory. | To verify the integrity of stage3 tarballs using GPG, first download your preferred stage3 taball, and the matching file with the additional {{c|.gpg}} extension in the same directory. Next, we will receive the public master key from a public keyserver, and assign ultimate trust to it: | ||
{{console|body= | {{console|body= | ||
# ##i##gpg --recv-key | # ##i##gpg --recv-key E986E8EE | ||
# ##i##gpg --recv-key | # ##i##gpg --edit-key E986E8EE | ||
# ##i##gpg --recv-key BEA87CD2 | gpg> ##i##trust | ||
}}Then, you can use the {{c|gpg --verify}} command to verify the signature: | Your decision? ##i##5 | ||
Do you really want to set this key to ultimate trust? (y/N) ##i##y | |||
gpg> ##i##quit | |||
}} | |||
Each build server key has been signed by the BDFL key, so by trusting the BDFL key, you will automatically trust the build server keys. | |||
Then, you will want to use the {{c|gpg --recv-key}} command, now specifying the ''the last 8 digits of the build server's primary key fingerprint'' listed above for each build server for which you want to verify signatures. The following command will grab public keys for all of the Funtoo Linux build servers listed above: | |||
{{console|body= | |||
# ##i##gpg --recv-key 11FD00FD 683A2F8A BEA87CD2 EEE54A43 | |||
}} | |||
Then, you can use the {{c|gpg --verify}} command to verify the stage3's GPG signature: | |||
{{console|body= | {{console|body= | ||
| Line 30: | Line 42: | ||
You should see output similar to this, which will specify the ''last 8 digits of the signing GPG fingerprint'': | You should see output similar to this, which will specify the ''last 8 digits of the signing GPG fingerprint'': | ||
{{console|body= | {{console|body= | ||
gpg: Signature made | gpg: Signature made Sun 25 Dec 2016 03:57:27 PM MST using RSA key ID 613539CB | ||
gpg: Good signature from "Daniel Robbins (metro: | gpg: checking the trustdb | ||
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model | |||
gpg: depth: 0 valid: 1 signed: 4 trust: 0-, 0q, 0n, 0m, 0f, 1u | |||
gpg: depth: 1 valid: 4 signed: 0 trust: 3-, 1q, 0n, 0m, 0f, 0u | |||
gpg: Good signature from "Daniel Robbins (metro:odroid-xu4) <drobbins@funtoo.org>" [full] | |||
}} | }} | ||
Revision as of 07:34, December 26, 2016
Funtoo Linux stage tarballs are signed using GPG by the build server they are built on. Each official Funtoo Linux build server has its own individual primary key and signing subkey. The following keys are used to create detached binary signatures ending in .gpg of each stage tarball. All keys are 4096 bit RSA with no expiry.
| GPG key name/email | GPG comment | Fingerprint | Used for |
|---|---|---|---|
Daniel Robbins drobbins@funtoo.org | metro:node | 3073 7D12 308C 9D0C 882F C34B 57CB 0A12 1BAE CB2E (Sign)70AC BB6B FEE7 BC57 2A89 41D1 9266 C4FA 11FD 00FD (Primary) | Generic and Intel builds |
Daniel Robbins drobbins@funtoo.org | metro:excavator | 3C56 18FB C28A B2FE 90C8 B9EB E510 18CD 4FF3 47DD (Sign)E8C5 7481 5DC1 74AF 5A9E 8385 3AA5 CA5E 683A 2F8A (Primary) | Most AMD builds |
Daniel Robbins drobbins@funtoo.org | metro:jaguar | 99AA ADED 1466 1BEF DC37 DE1B 7ABA 2235 4849 211D (Sign)6DDA E857 2788 8A7C A50E 2122 A902 1CE4 BEA8 7CD2 (Primary) | AMD Jaguar builds |
Daniel Robbins drobbins@funtoo.org | metro:odroid-xu4 | 4279 FBF8 FACC 261A 4F34 A486 4F88 3A02 6135 39CB (Sign)38E8 4AD5 3B01 590B A678 5E88 2A7B 0B2E EEE5 4A43 (Primary) | ARM 32-bit builds |
In turn, these public keys are signed by the Funtoo Linux master signing key:
| GPG key name/email | GPG comment | Fingerprint |
|---|---|---|
Daniel Robbins drobbins@funtoo.org | BDFL | D3B9 48F8 2EE8 B402 0A04 1078 9A65 8306 E986 E8EE |
To verify the integrity of stage3 tarballs using GPG, first download your preferred stage3 taball, and the matching file with the additional .gpg extension in the same directory. Next, we will receive the public master key from a public keyserver, and assign ultimate trust to it:
root # gpg --recv-key E986E8EE root # gpg --edit-key E986E8EE gpg> trust Your decision? 5 Do you really want to set this key to ultimate trust? (y/N) y gpg> quit
Each build server key has been signed by the BDFL key, so by trusting the BDFL key, you will automatically trust the build server keys.
Then, you will want to use the gpg --recv-key command, now specifying the the last 8 digits of the build server's primary key fingerprint listed above for each build server for which you want to verify signatures. The following command will grab public keys for all of the Funtoo Linux build servers listed above:
root # gpg --recv-key 11FD00FD 683A2F8A BEA87CD2 EEE54A43
Then, you can use the gpg --verify command to verify the stage3's GPG signature:
root # gpg --verify stage3-latest.tar.xz.gpg stage3-latest.tar.xz
You should see output similar to this, which will specify the last 8 digits of the signing GPG fingerprint:
gpg: Signature made Sun 25 Dec 2016 03:57:27 PM MST using RSA key ID 613539CB gpg: checking the trustdb gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model gpg: depth: 0 valid: 1 signed: 4 trust: 0-, 0q, 0n, 0m, 0f, 1u gpg: depth: 1 valid: 4 signed: 0 trust: 3-, 1q, 0n, 0m, 0f, 0u gpg: Good signature from "Daniel Robbins (metro:odroid-xu4) <drobbins@funtoo.org>" [full]