主页 / unix / 问题

问题[signature](unix)

Martin Hope
Marco Venuti
Asked: 2021-09-11 06:16:51 +0800 CST
  • 0

我想从包括所有非自签名的密钥服务器导入/刷新 gpg 密钥。例如，每当我尝试这样做时，gpg 都会说

gpg: key <number>: number of dropped non-self-signatures: 24
[...]
gpg: Total number processed: 1
gpg:              unchanged: 1

根据文档，这似乎是一种可取的行为，以避免导入充斥着虚假签名的密钥，但是我无法让 gpg 做我想做的事。

我尝试过导入/刷新密钥

gpg --verbose --import-options no-self-sigs-only --keyserver keyserver.ubuntu.com --recv-keys <fingerprint>

但输出是一样的。

gpg signature
Martin Hope
Tino
Asked: 2018-08-31 08:01:43 +0800 CST
  • 1

我正在运行 Devuan Jessie。我想从头开始安装另一个 Devuan Ascii。所以我下载了：

但我发现没有办法进行身份验证devuan-devs.gpg。

其他发行版（如 Debian 或 Ubuntu 或类似发行版）允许我从现有的先前版本验证 ISO。

但是对于Devuan，我没有找到任何办法：

tino@ts:~/ISO/devuan_ascii-2.0.0$ gpg --verify SHA256SUMS.asc
gpg: assuming signed data in `SHA256SUMS'
gpg: Signature made Wed 06 Jun 2018 08:55:55 PM CEST using DSA key ID 0B5F062F
gpg: Can't check signature: public key not found
tino@ts:~/ISO/devuan_ascii-2.0.0$ gpg --no-default-keyring --keyring /usr/share/keyrings/devuan-archive-keyring.gpg --verify SHA256SUMS.asc
gpg: assuming signed data in `SHA256SUMS'
gpg: Signature made Wed 06 Jun 2018 08:55:55 PM CEST using DSA key ID 0B5F062F
gpg: Can't check signature: public key not found
tino@ts:~/ISO/devuan_ascii-2.0.0$ gpg --no-default-keyring --keyring /usr/share/keyrings/devuan-keyring.gpg --verify SHA256SUMS.asc
gpg: assuming signed data in `SHA256SUMS'
gpg: Signature made Wed 06 Jun 2018 08:55:55 PM CEST using DSA key ID 0B5F062F
gpg: Can't check signature: public key not found

tino@ts:~/ISO/devuan_ascii-2.0.0$ gpg --keyring ../devuan-devs.gpg --verify SHA256SUMS.asc
gpg: assuming signed data in `SHA256SUMS'
gpg: Signature made Wed 06 Jun 2018 08:55:55 PM CEST using DSA key ID 0B5F062F
gpg: Good signature from "Vincenzo (KatolaZ) Nicosia <[email protected]>"
gpg:                 aka "Vincenzo Nicosia (KatolaZ) <[email protected]>"
gpg:                 aka "Vincenzo Nicosia (KatolaZ) <[email protected]>"
gpg:                 aka "KatolaZ <[email protected]>"
gpg:                 aka "Enzo Nicosia <[email protected]>"
gpg:                 aka "Enzo Nicosia -- KatolaZ <[email protected]>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 8E59 D6AA 445E FDB4 A153  3D5A 5F20 B3AE 0B5F 062F

由于“钥匙未经认证”，没有迹象表明钥匙不是假的。 如何修复这条破碎的信任链？

https://devuan.org/os/documentation/dev1fanboy/general-information也没有解决这个谜。

笔记：

devuan-devs.gpg大概不是假的。然而，这种假设并没有帮助。必须有某种方法来确保它不是假的。最初的母鸡问题已经解决了，因为 Devuan (Jessie) 已经在我身边跑了。

肯定有比将 Jessie 升级到 Ascii 更好的方法来验证 Ascii 的 ISO。正确的？

gpg signature