Score:0

How to Verify Putty Download with GPG CLI

cn flag

Downloaded from putty.org:

master-2021.asc putty-0.76.tar.gz putty-0.76.tar.gz.gpg release-2021.asc

opened terminal

gpg --import master-2021.asc

Output:

gpg: key DD4355EAAC1119DE: 4 signatures not checked due to missing keys
gpg: key DD4355EAAC1119DE: public key "PuTTY Master Key <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: no ultimately trusted keys found

Not sure what this means:

4 signatures not checked due to missing keys

But I use next commend:

gpg --import release-2021.asc

Output:

gpg: key E4F83EA2AA4915EC: public key "PuTTY Releases <[email protected]>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: no ultimately trusted keys found

Then I try to verify:

gpg --verify putty-0.76.tar.gz.gpg putty-0.76.tar.gz

Output:

gpg: Signature made Sat 17 Jul 2021 12:32:18 CEST
gpg:                using RSA key E27394ACA3F9D9049522E0546289A25F4AE8DA82
gpg: Can't check signature: No public key

What am I doing wrong?

David avatar
cn flag
Why did you not install it from Ubuntu software center?
cn flag
@David Didnt want or need PuTTY, I was just playing with gpg. Wanted to learn how it works in CLI. I found out what was wrong. The newest Public Key posted on Putty.org, is not the one used signing the download that I did. Needed an old Public key for that, which was also posted on their site. (2021 and 2018 Public Key). But solid valid question mate ;)
ar flag
Welcome to Ask Ubuntu. This is a question answer site, not a discussion forum. Please don't put SOLVED in the question title and put the answer inside the question. Press the **Answer your own question** button and write the solution to your question as an answer. Later, after the waiting period, accept your answer as the correct by clicking on the gray check mark next to your answer and turn it green ✅. This will mark your question as solved and help others.
cn flag
@user68186 thank you for correcting me. Ive followed your instructions and will keep it in mind for the next time.
Score:0
cn flag

Found what I was wrong; The newest Public Key posted on PuTTY.org, is not the Public Key that they used to Sign the file that I downloaded. I needed an older Public Key (From 2018) for that file, which was also posted on their site.

Took me a whole day. But finally understood all the gpg syntax/options/commands and combinations (or at least most of them)

GPG is AWESOME!!

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.