0

I'm running:

gpg2 --locate-keys [email protected] [email protected]

as specified in https://www.kernel.org/category/signatures.html

The command immediately returns, as if there were no tried in getting the keys from the server.

When I run gpg2 --verify linux-4.6.6.tar.sign I get

gpg: Can't check signature: No public key

2 Answers 2

3

I also couldn't have gpg2 --locate-keys working. Here are steps that worked for me.

Download kernel:

$ curl -O https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/linux-4.15.10.tar.xz
$ curl -O https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/linux-4.15.10.tar.sign

Unzip kernel:

$ unxz linux-4.15.10.tar.xz

Try to verify kernel:

$ gpg2 --verify linux-4.15.10.tar.sign
gpg: assuming signed data in 'linux-4.15.10.tar'
gpg: Signature made Thu 15 Mar 2018 12:57:15 PM MSK
gpg:                using RSA key 647F28654894E3BD457199BE38DBBDC86092693E
gpg: Can't check signature: No public key

Verification will fail , but you will get RSA key fingerprint: 647F28654894E3BD457199BE38DBBDC86092693E. Now receive corresponding public key with gpg2 --recv-keys:

$ gpg2 --recv-keys 647F28654894E3BD457199BE38DBBDC86092693E
gpg: key 38DBBDC86092693E: public key "Greg Kroah-Hartman <[email protected]>" imported
gpg: no ultimately trusted keys found
gpg: Total number processed: 1
gpg:               imported: 1

Now you have public key for mentioned above fingerprint. If you verify kernel again, you will get warning:

$ gpg2 --verify linux-4.15.10.tar.sign
gpg: assuming signed data in 'linux-4.15.10.tar'
gpg: Signature made Thu 15 Mar 2018 12:57:15 PM MSK
gpg:                using RSA key 647F28654894E3BD457199BE38DBBDC86092693E
gpg: Good signature from "Greg Kroah-Hartman <[email protected]>" [unknown]
gpg:                 aka "Greg Kroah-Hartman <[email protected]>" [unknown]
gpg:                 aka "Greg Kroah-Hartman (Linux kernel stable release signing key) <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 647F 2865 4894 E3BD 4571  99BE 38DB BDC8 6092 693E

Just as official kernel.org page says, you may opt to use TOFU trust model and verify kernel using it:

$ gpg2 --tofu-policy good 647F28654894E3BD457199BE38DBBDC86092693E
...
$ gpg2 --trust-model tofu --verify linux-4.15.10.tar.sign
gpg: assuming signed data in 'linux-4.15.10.tar'
gpg: Signature made Thu 15 Mar 2018 12:57:15 PM MSK
gpg:                using RSA key 647F28654894E3BD457199BE38DBBDC86092693E
gpg: checking the trustdb
gpg: no ultimately trusted keys found
gpg: Good signature from "Greg Kroah-Hartman <[email protected]>" [full]
gpg:                 aka "Greg Kroah-Hartman <[email protected]>" [full]
gpg:                 aka "Greg Kroah-Hartman (Linux kernel stable release signing key) <[email protected]>" [full]
gpg: [email protected]: Verified 1 signature in the past 0 seconds.  Encrypted 0 messages.
gpg: [email protected]: Verified 1 signature in the past 0 seconds. Encrypted 0 messages.
gpg: [email protected]: Verified 1 signature in the past 0 seconds. Encrypted 0 messages.

Verification is done. TOFU trust model is saved as default, so later you may use just gpg2 --verify linux-4.15.10.tar.sign to make further verifications.

0

It looks like you have to provide the method's via --auto-key-locate to get the keys:

$ gpg2 --auto-key-locate cert,pka,dane,wkd,keyserver --locate-keys [email protected] [email protected]
gpg: error retrieving '[email protected]' via DNS CERT: Not found
gpg: error retrieving '[email protected]' via PKA: Not found
gpg: error retrieving '[email protected]' via DANE: Not found
gpg: key 38DBBDC86092693E: public key "Greg Kroah-Hartman <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: automatically retrieved '[email protected]' via WKD
gpg: error retrieving '[email protected]' via DNS CERT: Not found
gpg: error retrieving '[email protected]' via PKA: Not found
gpg: error retrieving '[email protected]' via DANE: Not found
gpg: key 79BE3E4300411886: public key "Linus Torvalds <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: automatically retrieved '[email protected]' via WKD
pub   rsa4096 2011-09-23 [SC]
      647F28654894E3BD457199BE38DBBDC86092693E
uid           [ unknown] Greg Kroah-Hartman <[email protected]>
uid           [ unknown] Greg Kroah-Hartman (Linux kernel stable release signing key) <[email protected]>
uid           [ unknown] Greg Kroah-Hartman <[email protected]>
sub   rsa4096 2011-09-23 [E]

pub   rsa2048 2011-09-20 [SC]
      ABAF11C65A2970B130ABE3C479BE3E4300411886
uid           [ unknown] Linus Torvalds <[email protected]>
uid           [ unknown] Linus Torvalds <[email protected]>
sub   rsa2048 2011-09-20 [E]
1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .