Information on my PGP public key¶
What is this about?¶
Where and when do I use it?¶
Sign to ensure the origin of a file¶
I tried to take the habit of signing the important files (binaries, PDF etc) that can be downloaded on this website (and the other websites I use).
This allow any one to be sure that she/he downloaded the correct file: my signing key is private, so I should (hopefully) be the only one able to produce these digital signatures.
Most of the addresses (
URLs) of files I give on these web-pages can be appended with
.asc at the end of the address to download the signature:
for instance, cv.en.pdf and cv.en.pdf.asc, or for this page:
pgp.en.html has its signature in this file pgp.en.html.asc.
With the sphinx-doc extension
sphinx.ext.runblock, it is possible to
include here in this web-page the command that was used to generate this digital signature (and its output):
$ LANG=en gpg --detach-sign --armor --quiet -o - /home/lilian/.bashrc -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEE/DSleRq5aEZtX0W7LaPXUOHniXEFAmEmIRQACgkQLaPXUOHn iXFnXBAAn+8IcD3X//CmK6BEE6xeLGLdfOMDM0fPSJzpnkH1sRni524QI2sC+3kb wtKfsHZVyL5cAge/9peQ4n/uDJ3mWHlAWoXItfRA68kmiZY5WSKP5FB4srICHhJy qDwhm7N9Q75ADEOqnHxooKahdKp/nn1eP2KHuzz+vPq9Jew56vNANb7SmXvbjUGU 9rmXc2FIQw5AClH9/0IneSw4oNmRdc74PEvm50dQtDTC1FENq8A1EqSJbpzxijiD BiZnLAhfHXgBp5U0UwfFEwAQFRPsSH/Z/ud94LmVKiibbNANwy7ih/pRhsgF33eU BT8EN4M/z1q2k6QnRk2nNCzfQK/YDzbCvxZJO+spSsuYNi6XjapTvX9unyPkPTlG QNvVyyJe+/Rn2E6Bts0XYtPUa0+cJ7pRvZX0dqJCVMpBPFxDgJ47BmJy6CVNVZ4b 2xHSTrHn8lf3GhPT0vOq32OYsWwZxuEWUtkja+acno3OdkUXMghUP4O/AUV7+xyP vzz8e+gflS7qeA0gP+PFSBjk3CZkYmuFvANqztFftPpsZa8zUEn8Hkf6+xTiP/WL me7Ohmy9QHUTzVzsxnmc2DYVYrCLsmzO9hrFa8Mg40IqP6OfSGWL94nS46Z2lVFC FZF6MlzpYHz7RGJtvvQle3OsbTpi/mVFVffgKomglWXv0V41mNo= =mTdN -----END PGP SIGNATURE-----
How to use these .asc files?¶
It is possible to check these signatures, with my public key. And that’s the main purpose of the .asc files!
First, you have to import my public key in your list of trusted keys (trust-ring).
In this case, my public key is in this file Lilian_Besson.asc, and you need:
to download it, as explained in the next paragraph;
and then check its MD5 and SHA256 checksums, to be sure you downloaded the good file! Simply compare the output of the
sha256sumcommands to the one bellow.
From my trust ring:$ LANG=en GPGKEY=`gpg.sh` gpg --export --armor $GPGKEY | md5sum $ LANG=en GPGKEY=`gpg.sh` gpg --export --armor $GPGKEY | sha256sum bash: ligne 1: gpg.sh : commande introuvable gpg: WARNING: nothing exported bash: ligne 2: gpg.sh : commande introuvable gpg: WARNING: nothing exported
And from the file you downloaded Lilian_Besson.asc :$ # Use ./Lilian_Besson.asc to check the file in the current directory $ md5sum ~/Lilian_Besson.asc $ sha256sum ~/Lilian_Besson.asc md5sum: /home/lilian/Lilian_Besson.asc: Aucun fichier ou dossier de ce type sha256sum: /home/lilian/Lilian_Besson.asc: Aucun fichier ou dossier de ce type
This step is simply here to check that you downloaded the good public key (the .asc file is its armor-art, ie. an ASCII representation of its content).
Then you have to import it in your trust ring (locally on your machine) :gpg --import Lilian_Besson.asc
And now, you can check the signature file.asc of any file file, with this simple command:
gpg --verify file.asc file
And so for the .bashrc file, if you downloaded it and its signature, you just have to do:
gpg --verify .bashrc.asc .bashrc
Then, hopefully, if you downloaded the files, and have imported my public key, it should give you a message like this one:
$ LANG=en gpg --verify ~/.bashrc.asc ~/.bashrc gpg: Signature made Sun Feb 21 23:28:38 2021 CET gpg: using RSA key FC34A5791AB968466D5F45BB2DA3D750E1E78971 gpg: Good signature from "Lilian Besson (@Naereen) <firstname.lastname@example.org>" [ultimate]
It should work just fine!
My public key¶
The public footprint of my key is C108F8A0.
One simpler way of importing my key is to simply look for it directly! From one of these two servers:
A quick look-up on these PGP key server gives: