Information on my PGP public key¶
Avertissement
I no longer use my PGP key, but these informations might still be useful.
What is this about?¶
I could not explain better than our dear Wikipedia friend: GPG on Wikipedia. Another good reference is this wikibook on GPG.
I suggest you go read these, to learn more on GPG or to refresh your ideas on the subject, before reading more this page.
Where and when do I use it?¶
Sign to ensure the origin of a file¶
I tried to take the habit of signing the important files (binaries, PDF etc) that can be downloaded on this website (and the other websites I use).
This allow any one to be sure that she/he downloaded the correct file: my signing key is private, so I should (hopefully) be the only one able to produce these digital signatures.
Most of the addresses (URLs) of files I give on these web-pages can be appended with
a short .asc at the end of the address to download the signature:
for instance, cv.en.pdf and cv.en.pdf.asc, or for this page:
pgp.en.html has its signature in this file pgp.en.html.asc.
More examples¶
For instance, my Bash profile file, .bashrc, has a signature .bashrc.asc.
With the sphinx-doc extension sphinx.ext.runblock, it is possible to
include here in this web-page the command that was used to generate this digital signature (and its output):
How to use these .asc files?¶
It is possible to check these signatures, with my public key. And that’s the main purpose of the .asc files!
First, you have to import my public key in your list of trusted keys (trust-ring).
In this case, my public key is in this file Lilian_Besson.asc, and you need:
to download it, as explained in the next paragraph;
and then check its MD5 and SHA256 checksums, to be sure you downloaded the good file! Simply compare the output of the
md5sumandsha256sumcommands to the one bellow.From my trust ring:
And from the file you downloaded Lilian_Besson.asc :
This step is simply here to check that you downloaded the good public key (the .asc file is its armor-art, ie. an ASCII representation of its content).
Then you have to import it in your trust ring (locally on your machine) :
gpg --import Lilian_Besson.asc
And now, you can check the signature file.asc of any file file, with this simple command:
gpg --verify file.asc file
Example (2)¶
And so for the .bashrc file, if you downloaded it and its signature, you just have to do:
gpg --verify .bashrc.asc .bashrc
Then, hopefully, if you downloaded the files, and have imported my public key, it should give you a message like this one:
It should work just fine!
My public key¶
The public footprint of my key is C108F8A0.
One simpler way of importing my key is to simply look for it directly! From one of these two servers:
keyserver.ubuntu.com;
pgp.mit.edu.
A quick look-up on these PGP key server gives:
