# How to Verify Git GPG Signed Downloads? 5 messages from 2021-01-24 to 2021-01-25. Participants: Brooke Kuhlmann, Jason Pyeron, brian m. carlson, Junio C Hamano. Thread: https://gitlist.dev/t/55041 ## Brooke Kuhlmann, 2021-01-24 16:49 Subject: How to Verify Git GPG Signed Downloads? Message-ID: URL: https://gitlist.dev/e/B6DFB74D-A722-4DBD-A4B2-562604B21CCB%40alchemists.io ``` Hello, I'm trying to figure out how to obtain the public key used to encrypt the Git file downloads. I put together a gist that explains the problem and question in detail here: https://gist.github.com/bkuhlmann/684b74d25d83d52df8d0caeb6219aa15 If anyone has any advice on how to make this possible, it would be greatly appreciated. Thanks, Brooke ``` ## Jason Pyeron, 2021-01-24 17:57 Subject: RE: How to Verify Git GPG Signed Downloads? Message-ID: <022601d6f27a$58a97200$09fc5600$@pdinc.us> URL: https://gitlist.dev/e/022601d6f27a%2458a97200%2409fc5600%24%40pdinc.us In-Reply-To: ``` > From: Brooke Kuhlmann > Sent: Sunday, January 24, 2021 11:49 AM > > Hello, I'm trying to figure out how to obtain the public key used to > encrypt Do you mean sign? > the Git file > downloads. I put together a gist that explains the problem and question in detail here: > > https://gist.github.com/bkuhlmann/684b74d25d83d52df8d0caeb6219aa15 Please don’t post links to questions, pasting your content inline here: > Problem > When attempting to download a Git version, it would be nice to verify the signature of the download by running the following: > > curl --remote-name https://mirrors.edge.kernel.org/pub/software/scm/git/git-2.30.0.tar.gz > curl --remote-name https://mirrors.edge.kernel.org/pub/software/scm/git/git-2.30.0.tar.sign > gpg --verify git-2.30.0.tar.sign git-2.30.0.tar.gz > Only problem is that the last line of the above throws the following error: > > gpg: Signature made Sun Dec 27 23:12:30 2020 MST > gpg: using RSA key E1F036B1FEE7221FC778ECEFB0B5E88696AFE6CB > gpg: Can't check signature: No public key > I tried using the following solutions to no avail: $ gpg --recv-keys 96AFE6CB gpg: requesting key 96AFE6CB from hkp server keys.gnupg.net gpg: key 713660A7: "Junio C Hamano " 59 new signatures gpg: key 713660A7: "Junio C Hamano " 2 new subkeys gpg: no ultimately trusted keys found gpg: Total number processed: 1 gpg: new subkeys: 2 gpg: new signatures: 59 $ gpg --verify -v git-2.30.0.tar.sign git-2.30.0.tar.gz gpg: Signature made Mon Dec 28 01:12:30 2020 EST using RSA key ID 96AFE6CB gpg: NOTE: signature key 96AFE6CB expired Sun Jul 26 13:41:24 2020 EDT gpg: NOTE: signature key B3F7CAC9 expired Sun Jul 26 13:41:42 2020 EDT gpg: using subkey 96AFE6CB instead of primary key 713660A7 gpg: NOTE: signature key 96AFE6CB expired Sun Jul 26 13:41:24 2020 EDT gpg: NOTE: signature key 96AFE6CB expired Sun Jul 26 13:41:24 2020 EDT gpg: NOTE: signature key B3F7CAC9 expired Sun Jul 26 13:41:42 2020 EDT gpg: using PGP trust model gpg: BAD signature from "Junio C Hamano " gpg: binary signature, digest algorithm SHA256 $ gpg --list-keys -v 96AFE6CB gpg: using PGP trust model gpg: NOTE: signature key 96AFE6CB expired Sun Jul 26 13:41:24 2020 EDT gpg: NOTE: signature key B3F7CAC9 expired Sun Jul 26 13:41:42 2020 EDT pub 4096R/713660A7 2011-10-01 uid Junio C Hamano uid Junio C Hamano uid Junio C Hamano sub 4096R/96AFE6CB 2011-10-03 [expired: 2020-07-26] sub 4096R/833262C4 2011-10-01 sub 4096R/B3F7CAC9 2014-09-20 [expired: 2020-07-26] It is possible that Junio forgot to push his refreshed public key. > > gpg --locate-keys torvalds@kernel.org gregkh@kernel.org committer@example.com discord@example.net gitster@pobox.com > gpg --import # <= Need a file to import but where does one obtain the public key? > I also tried importing only the public keys from the Git repository via the following files without any luck either: > > t/lib-gpg/keyring.gpg > contrib/credential/netrc/test.git-config-gpg > contrib/credential/netrc/test.netrc.gpg > contrib/credential/netrc/test.command-option-gpg > Question > How does one figure out how to obtain the public keys for which the Git downloads were signed? > > If anyone has any advice on how to make this possible, it would be greatly appreciated. > > Thanks, > Brooke > ``` ## brian m. carlson, 2021-01-24 21:33 Subject: Re: How to Verify Git GPG Signed Downloads? Message-ID: URL: https://gitlist.dev/e/YA3nwFcYz4tbhrlO%40camp.crustytoothpaste.net In-Reply-To: <022601d6f27a$58a97200$09fc5600$@pdinc.us> ``` On 2021-01-24 at 17:57:13, Jason Pyeron wrote: > $ gpg --recv-keys 96AFE6CB > gpg: requesting key 96AFE6CB from hkp server keys.gnupg.net > gpg: key 713660A7: "Junio C Hamano " 59 new signatures > gpg: key 713660A7: "Junio C Hamano " 2 new subkeys > gpg: no ultimately trusted keys found > gpg: Total number processed: 1 > gpg: new subkeys: 2 > gpg: new signatures: 59 > > $ gpg --verify -v git-2.30.0.tar.sign git-2.30.0.tar.gz > gpg: Signature made Mon Dec 28 01:12:30 2020 EST using RSA key ID 96AFE6CB > gpg: NOTE: signature key 96AFE6CB expired Sun Jul 26 13:41:24 2020 EDT > gpg: NOTE: signature key B3F7CAC9 expired Sun Jul 26 13:41:42 2020 EDT > gpg: using subkey 96AFE6CB instead of primary key 713660A7 > gpg: NOTE: signature key 96AFE6CB expired Sun Jul 26 13:41:24 2020 EDT > gpg: NOTE: signature key 96AFE6CB expired Sun Jul 26 13:41:24 2020 EDT > gpg: NOTE: signature key B3F7CAC9 expired Sun Jul 26 13:41:42 2020 EDT > gpg: using PGP trust model > gpg: BAD signature from "Junio C Hamano " > gpg: binary signature, digest algorithm SHA256 The signature is bad because it's over the uncompressed .tar, not the .tar.gz. There is also a .tar.xz and the signature is the same. You therefore need to uncompress it first with gunzip. > $ gpg --list-keys -v 96AFE6CB > gpg: using PGP trust model > gpg: NOTE: signature key 96AFE6CB expired Sun Jul 26 13:41:24 2020 EDT > gpg: NOTE: signature key B3F7CAC9 expired Sun Jul 26 13:41:42 2020 EDT > pub 4096R/713660A7 2011-10-01 > uid Junio C Hamano > uid Junio C Hamano > uid Junio C Hamano > sub 4096R/96AFE6CB 2011-10-03 [expired: 2020-07-26] > sub 4096R/833262C4 2011-10-01 > sub 4096R/B3F7CAC9 2014-09-20 [expired: 2020-07-26] > > It is possible that Junio forgot to push his refreshed public key. Yes, I think that's the case. -- brian m. carlson (he/him or they/them) Houston, Texas, US ``` ## Jason Pyeron, 2021-01-24 22:24 Subject: RE: How to Verify Git GPG Signed Downloads? Message-ID: <06be01d6f29f$ae6450a0$0b2cf1e0$@pdinc.us> URL: https://gitlist.dev/e/06be01d6f29f%24ae6450a0%240b2cf1e0%24%40pdinc.us In-Reply-To: ``` > From: brian m. carlson > Sent: Sunday, January 24, 2021 4:34 PM > > On 2021-01-24 at 17:57:13, Jason Pyeron wrote: > > $ gpg --recv-keys 96AFE6CB > > gpg: requesting key 96AFE6CB from hkp server keys.gnupg.net > > gpg: key 713660A7: "Junio C Hamano " 59 new signatures > > gpg: key 713660A7: "Junio C Hamano " 2 new subkeys > > gpg: no ultimately trusted keys found > > gpg: Total number processed: 1 > > gpg: new subkeys: 2 > > gpg: new signatures: 59 > > > > $ gpg --verify -v git-2.30.0.tar.sign git-2.30.0.tar.gz > > gpg: Signature made Mon Dec 28 01:12:30 2020 EST using RSA key ID 96AFE6CB > > gpg: NOTE: signature key 96AFE6CB expired Sun Jul 26 13:41:24 2020 EDT > > gpg: NOTE: signature key B3F7CAC9 expired Sun Jul 26 13:41:42 2020 EDT > > gpg: using subkey 96AFE6CB instead of primary key 713660A7 > > gpg: NOTE: signature key 96AFE6CB expired Sun Jul 26 13:41:24 2020 EDT > > gpg: NOTE: signature key 96AFE6CB expired Sun Jul 26 13:41:24 2020 EDT > > gpg: NOTE: signature key B3F7CAC9 expired Sun Jul 26 13:41:42 2020 EDT > > gpg: using PGP trust model > > gpg: BAD signature from "Junio C Hamano " > > gpg: binary signature, digest algorithm SHA256 > > The signature is bad because it's over the uncompressed .tar, not the > .tar.gz. There is also a .tar.xz and the signature is the same. You > therefore need to uncompress it first with gunzip. Silly me, but maybe there should be a README in that directory, along with the signatures.asc. If not, then it should easily be found on the git-scm site. $ gpg --verify git-2.30.0.tar.sign git-2.30.0.tar gpg: Signature made Mon Dec 28 01:12:30 2020 EST using RSA key ID 96AFE6CB gpg: Good signature from "Junio C Hamano " gpg: aka "Junio C Hamano " gpg: aka "Junio C Hamano " gpg: Note: This key has expired! Primary key fingerprint: 96E0 7AF2 5771 9559 80DA D100 20D0 4E5A 7136 60A7 Subkey fingerprint: E1F0 36B1 FEE7 221F C778 ECEF B0B5 E886 96AF E6CB > > > $ gpg --list-keys -v 96AFE6CB > > gpg: using PGP trust model > > gpg: NOTE: signature key 96AFE6CB expired Sun Jul 26 13:41:24 2020 EDT > > gpg: NOTE: signature key B3F7CAC9 expired Sun Jul 26 13:41:42 2020 EDT > > pub 4096R/713660A7 2011-10-01 > > uid Junio C Hamano > > uid Junio C Hamano > > uid Junio C Hamano > > sub 4096R/96AFE6CB 2011-10-03 [expired: 2020-07-26] > > sub 4096R/833262C4 2011-10-01 > > sub 4096R/B3F7CAC9 2014-09-20 [expired: 2020-07-26] > > > > It is possible that Junio forgot to push his refreshed public key. > > Yes, I think that's the case. ``` ## Junio C Hamano, 2021-01-25 01:03 Subject: Re: How to Verify Git GPG Signed Downloads? Message-ID: URL: https://gitlist.dev/e/xmqqh7n5zv2b.fsf%40gitster.c.googlers.com In-Reply-To: ``` "brian m. carlson" writes: >> $ gpg --list-keys -v 96AFE6CB >> gpg: using PGP trust model >> gpg: NOTE: signature key 96AFE6CB expired Sun Jul 26 13:41:24 2020 EDT >> gpg: NOTE: signature key B3F7CAC9 expired Sun Jul 26 13:41:42 2020 EDT >> pub 4096R/713660A7 2011-10-01 >> uid Junio C Hamano >> uid Junio C Hamano >> uid Junio C Hamano >> sub 4096R/96AFE6CB 2011-10-03 [expired: 2020-07-26] >> sub 4096R/833262C4 2011-10-01 >> sub 4096R/B3F7CAC9 2014-09-20 [expired: 2020-07-26] >> >> It is possible that Junio forgot to push his refreshed public key. > > Yes, I think that's the case. Hmph, I was fairly sure I pushed it out when I refreshed the expiry date sometime early last year, but apparently it did not go through. I just tried recv-keys from keys.gnupg.net into a throw-away GNUPGHOME and got the output at the end, so it should be OK now. Sorry about that. $ gpg --list-keys -v 96AFE6CB gpg: using pgp trust model pub rsa4096 2011-10-01 [SC] 96E07AF25771955980DAD10020D04E5A713660A7 uid [ unknown] Junio C Hamano uid [ unknown] Junio C Hamano uid [ unknown] Junio C Hamano sub rsa4096 2011-10-01 [E] sub rsa4096 2011-10-03 [S] [expires: 2028-01-11] sub rsa4096 2014-09-20 [S] [expires: 2028-01-11] ```