[gentoo-dev] gpg key for iso's

[gentoo-dev] gpg key for iso's

[Nick Rout]

where do i get the official public key to check iso files against? i
must say it is not obvious:

1. on the website front page.
2. on the "get gentoo" pages
3. on the mirrors.

Thanks.
-- 
Nick Rout <nick@rout.co.nz>


--
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] gpg key for iso's

[Drake Wyrm]

[-- Attachment #1: Type: text/plain, Size: 774 bytes --]

On Thu, 2004-05-06, 11:41:42 +1200, in
<20040506113415.2BCE.NICK@rout.co.nz>, Nick Rout <nick@rout.co.nz>
wrote:
> where do i get the official public key to check iso files against? i
> must say it is not obvious:
> 
> 1. on the website front page. 2. on the "get gentoo" pages 3. on the
> mirrors.

The key is probably available on one of the keyservers. In your
gpg.conf, make sure you have a keyserver defined (just uncomment one of
them). You may also want to add "auto-key-retrieve" to
keyserver-options. When you verify the iso, gpg will fetch the key if it
is not already in your public keyring.

-- 
Batou: Hey, Major... You ever hear of "human rights"?
Kusanagi: I understand the concept, but I've never seen it in action.
  --Ghost in the Shell

[-- Attachment #2: Type: application/pgp-signature, Size: 197 bytes --]

Re: [gentoo-dev] gpg key for iso's

[Nick Rout]

ok, thanks, that worked.

set (in ~/.gnupg/gpg.conf)

keyserver x-hkp://pgp.mit.edu
keyserver-options auto-key-retrieve

and it seems to tell me that zhen signed the iso.

cool.

On Wed, 5 May 2004 17:37:32 -0700
Drake Wyrm <wyrm@haell.com> wrote:

> On Thu, 2004-05-06, 11:41:42 +1200, in
> <20040506113415.2BCE.NICK@rout.co.nz>, Nick Rout <nick@rout.co.nz>
> wrote:
> > where do i get the official public key to check iso files against? i
> > must say it is not obvious:
> > 
> > 1. on the website front page. 2. on the "get gentoo" pages 3. on the
> > mirrors.
> 
> The key is probably available on one of the keyservers. In your
> gpg.conf, make sure you have a keyserver defined (just uncomment one of
> them). You may also want to add "auto-key-retrieve" to
> keyserver-options. When you verify the iso, gpg will fetch the key if it
> is not already in your public keyring.
> 
> -- 
> Batou: Hey, Major... You ever hear of "human rights"?
> Kusanagi: I understand the concept, but I've never seen it in action.
>   --Ghost in the Shell

-- 
Nick Rout <nick@rout.co.nz>


--
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] gpg key for iso's

[Nick Rout]

should there be instructions for this more promiently somewhere??


On Thu, 06 May 2004 12:38:36 +1200
Nick Rout <nick@rout.co.nz> wrote:

> ok, thanks, that worked.
> 
> set (in ~/.gnupg/gpg.conf)
> 
> keyserver x-hkp://pgp.mit.edu
> keyserver-options auto-key-retrieve
> 
> and it seems to tell me that zhen signed the iso.
> 
> cool.
> 
> On Wed, 5 May 2004 17:37:32 -0700
> Drake Wyrm <wyrm@haell.com> wrote:
> 
> > On Thu, 2004-05-06, 11:41:42 +1200, in
> > <20040506113415.2BCE.NICK@rout.co.nz>, Nick Rout <nick@rout.co.nz>
> > wrote:
> > > where do i get the official public key to check iso files against? i
> > > must say it is not obvious:
> > > 
> > > 1. on the website front page. 2. on the "get gentoo" pages 3. on the
> > > mirrors.
> > 
> > The key is probably available on one of the keyservers. In your
> > gpg.conf, make sure you have a keyserver defined (just uncomment one of
> > them). You may also want to add "auto-key-retrieve" to
> > keyserver-options. When you verify the iso, gpg will fetch the key if it
> > is not already in your public keyring.
> > 
> > -- 
> > Batou: Hey, Major... You ever hear of "human rights"?
> > Kusanagi: I understand the concept, but I've never seen it in action.
> >   --Ghost in the Shell
> 
> -- 
> Nick Rout <nick@rout.co.nz>
> 
> 
> --
> gentoo-dev@gentoo.org mailing list

-- 
Nick Rout <nick@rout.co.nz>


--
gentoo-dev@gentoo.org mailing list

Re: [gentoo-dev] gpg key for iso's

[Drake Wyrm]

[-- Attachment #1: Type: text/plain, Size: 1296 bytes --]

On Thu, 2004-05-06, 12:42:25 +1200, in
<20040506124202.2BD9.NICK@rout.co.nz>, Nick Rout <nick@rout.co.nz>
wrote:
> On Thu, 06 May 2004 12:38:36 +1200 Nick Rout <nick@rout.co.nz> wrote:
> > On Wed, 5 May 2004 17:37:32 -0700 Drake Wyrm <wyrm@haell.com> wrote:
> > > On Thu, 2004-05-06, 11:41:42 +1200, in
> > > <20040506113415.2BCE.NICK@rout.co.nz>, Nick Rout <nick@rout.co.nz>
> > > wrote:
> > > > where do i get the official public key to check iso files
> > > > against? i must say it is not obvious:
[snip]
> > 
> > ok, thanks, that worked.
> > 
> > set (in ~/.gnupg/gpg.conf)
> > 
> > keyserver x-hkp://pgp.mit.edu
> > keyserver-options auto-key-retrieve
> > 
> > and it seems to tell me that zhen signed the iso.
> 
> should there be instructions for this more promiently somewhere??

Probably. I looked around for official guidance before I first replied,
but nothing jumped out and bit me. Wait and see if anybody else chimes
in with sagely wisdom. If not, file a bug. There probably *is* a
repository of keys somewhere around Gentoo. The closest thing I could
find, though, is GLEP12 (which is defunct).

-- 
Batou: Hey, Major... You ever hear of "human rights"?
Kusanagi: I understand the concept, but I've never seen it in action.
  --Ghost in the Shell

[-- Attachment #2: Type: application/pgp-signature, Size: 197 bytes --]

Re: [gentoo-dev] gpg key for iso's

[Sven Vermeulen]

[-- Attachment #1: Type: text/plain, Size: 666 bytes --]

On Thu, May 06, 2004 at 12:42:25PM +1200, Nick Rout wrote:
> should there be instructions for this more promiently somewhere??

They'll be put in the installation instructions (#49376) but I'm currently
unable to do much work on docs. Perhaps someone else on the documentation
team wants to take it? It's still unassigned afaik. Hopefully I can do a
bugsquashing event again sunday that'll reduce the number of documentation 
bugs to a bare minimum again :)

Wkr,
      Sven Vermeulen

-- 
 ^__^   And Larry saw that it was Good.
 (oo)                                      Sven Vermeulen
 (__)   http://www.gentoo.org              Documentation & PR

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] gpg key for iso's

[Josh Glover]

[-- Attachment #1: Type: text/plain, Size: 335 bytes --]

Quoth Nick Rout (Thu 2004-05-06 12:42:25PM +1200):

> should there be instructions for this more promiently somewhere??

I thought so:

http://bugs.gentoo.org/show_bug.cgi?id=49376

-- 
Josh Glover

GPG keyID 0xDE8A3103 (C3E4 FA9E 1E07 BBDB 6D8B  07AB 2BF1 67A1 DE8A 3103)
gpg --keyserver pgp.mit.edu --recv-keys DE8A3103

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: [gentoo-dev] gpg key for iso's

[Nick Rout]

Frankly, IM very HO there should be a reference on the front page. Not
everyone downloading is necessarily doing an install straight away, they
may be burning cd's for friends or a lug, or any number of other things. 

How about a link on the home page or a reference on the "get gentoo"
page?

I'll shut up now :-)

On Thu, 6 May 2004 07:42:36 -0400
Josh Glover <gentoo@jmglov.net> wrote:

> Quoth Nick Rout (Thu 2004-05-06 12:42:25PM +1200):
> 
> > should there be instructions for this more promiently somewhere??
> 
> I thought so:
> 
> http://bugs.gentoo.org/show_bug.cgi?id=49376
> 
> -- 
> Josh Glover
> 
> GPG keyID 0xDE8A3103 (C3E4 FA9E 1E07 BBDB 6D8B  07AB 2BF1 67A1 DE8A 3103)
> gpg --keyserver pgp.mit.edu --recv-keys DE8A3103

-- 
Nick Rout <nick@rout.co.nz>


--
gentoo-dev@gentoo.org mailing list