When it comes to installing software on a Linux system, the process is typically straightforward. Most of the time, you'll rely on a package manager like apt, dnf, or Pacman to safely install software from your distribution's repositories.

However, there are cases where the desired software isn't available in the official repository of your Linux distribution. In such situations, you might need to download the software directly from the vendor’s website. But how can you be certain that the downloaded file hasn’t been altered or compromised? That's exactly what we're going to explore. This guide will walk you through the steps to verify the PGP signature of a downloaded software package in Linux.

PGP (Pretty Good Privacy) is a cryptographic tool used for signing and encrypting files. Many software developers use PGP tools like GPG (GNU Privacy Guard) to sign their software releases.

GPG, which implements the OpenPGP standard, allows for secure data transmission and also helps confirm the integrity of a source. Similarly, you can utilize GPG to ensure that the software you’ve downloaded hasn’t been tampered with.

The verification process involves five main steps:

• Download the public key of the software developer.
• Verify the fingerprint of the public key.
• Import the public key into your keyring.
• Download the software’s signature file.
• Use GPG to verify the signature against the downloaded package.

To illustrate this process, we’ll use Tixati, a peer-to-peer file sharing application, as an example. We have already downloaded the Debian package from the official Tixati website.

Verifying the PGP Signature of Tixati

First, we need to download the public key used by the developer to sign the software. This key is usually available on the software's official download page.

Use the wget command in your terminal to fetch the public key:

<code>$ wget https://www.tixati.com/tixati.key</code>

Check the Fingerprint of the Public Key

After downloading the key, the next step is to examine its fingerprint using the gpg command:

<code>$ gpg --show-keys tixati.key</code>

The fingerprint will be displayed in the output, as highlighted below.

Import the GPG Key

Once the fingerprint has been verified, import the key into your GPG keyring. This is a one-time requirement.

<code>$ gpg --import tixati.key</code>

Download the Software Signature File

Now, download the corresponding PGP signature file for the software package. It is often located next to the software file and ends with a .asc extension.

Run the following command to download the signature:

<code>$ wget https://download2.tixati.com/download/tixati_2.84-1_amd64.deb.asc</code>

Verify the Signature Against the Package

Finally, verify the signature using the downloaded .asc file and the Debian package itself:

<code>$ gpg --verify tixati_2.84-1_amd64.deb.asc tixati_2.84-1_amd64.deb</code>

The third line of the output confirms that the signature was generated by the software author—in this case, Tixati Software Inc. Additionally, the fingerprint shown matches the one we previously verified, confirming the authenticity of the PGP signature.

We hope this guide helped you understand how to verify the PGP signature of a downloaded software package in Linux.

The above is the detailed content of How to Verify PGP Signature of Downloaded Software on Linux. For more information, please follow other related articles on the PHP Chinese website!