Re: download verification via .sig

On Mon, 2011-08-08 at 10:49 -0400, Ray Stell wrote:
> How do you use this .sig to verify a download?
> pgadmin3-1.12.3.dmg
> pgadmin3-1.12.3.dmg.sig
>
>

The package is signed with Dave Page's GPG key. His public key is
available here:
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x96020E041A19643B

Once the public key has been imported, a simple "gpg --verify
pgadmin3-1.12.3.dmg.sig" allows you to check the file:

[guillaume(at)laptop ~]$ gpg --verify pgadmin3-1.14.0-beta3.zip.sig
gpg: Signature made Fri 08 Jul 2011 11:52:12 AM CEST using DSA key ID
1A19643B
gpg: Good signature from "Dave Page <dpage(at)postgresql(dot)org>"
gpg: aka "Dave Page <dpage(at)pgadmin(dot)org>"
gpg: aka "Dave Page <dave(dot)page(at)enterprisedb(dot)com>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the
owner.
Primary key fingerprint: 752C 3D8A 5274 C381 9231 7EAA 9602 0E04 1A19
643B

--
Guillaume
http://blog.guillaume.lelarge.info
http://www.dalibo.com