Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I have successfully completed steps 1-4 in an attempt to verify the PGP signature of a downloaded TrueCrypt setup file. But I can't figure out how to complete step 5 using Seahorse.

Does anyone know how to verify the downloaded signature using seahorse? I downloaded the .sig file to my desktop.

To verify a PGP signature, follow these steps:

  1. Create a private PGP key
  2. Download our PGP public key from our server.
  3. Sign the imported key with your private key to mark it as trusted.
  4. Download the digital signature
  5. Verify the downloaded signature
share|improve this question

2 Answers 2

I do not think you can do all of the steps with Seahorse and the seahorse plugins do not seem to be maintained beyond 11.04.

Create a gpg key

Start seahorse , under the main menu New -> Create a new GPG key

New gpg key

Fill in the subsequent information and password

Info passwd

2) Download the PGP key from Truecrypt You can do this with any browser, save the file where you wish. For this tutorial I will use Downloads in your home directory.

http://www.truecrypt.org/downloads2

The file is called "TrueCrypt-Foundation-Public-Key.asc"

https://www.truecrypt.org/download/TrueCrypt-Foundation-Public-Key.asc

3) With seahorse, import and sign the key

In the seahorse menu -> File -> Import

Select the truecrypt key ( "TrueCrypt-Foundation-Public-Key.asc" )

Now sign the key as trusted

Under the "other" tab, select the truecrypt key and sign it as trusted

Trust 1

Trust 2

Trust 3

4) Download the truecrypt PGP signature from here, save it in Downloads

http://www.truecrypt.org/downloads

5) As far as I know, you can only verify the signature from the command line

cd ~/Desktop
~/Desktop$ gpg truecrypt-7.1a-linux-x86.tar.gz.sig --verify truecrypt-6.2a-ubuntu-x86.tar.gz

Should yield

gpg: Good signature from "TrueCrypt Foundation "

See also http://mindlev.wordpress.com/2009/09/07/verifying-the-truecrypt-installer-package-on-ubuntu/

share|improve this answer
1  
In my experience, the .sig file needs to be first in the gpg --verify command. –  E-man Jan 20 '13 at 23:16
    
@E-man is right. The .sig file is the first arg. –  YuriC Mar 5 '13 at 12:33
    
@YuriC thank you –  bodhi.zazen Mar 5 '13 at 16:12

Simply typing (in a shell in the directory where both files are)

gpg --verify TrueCrypt.sig TrueCrypt-ProgramFile

will give the same results without having to create any thing on your side. At least this worked from my experience. This tutorial did help though. :)

Also, if you just type the first part of the file name like True in this case you can hit the Tab key and it will auto-complete. :D

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.