PGP signatures
Several archives distributed onto this site are cryptographically signed using OpenPGP-compliant signatures. Everyone is encouraged to check the integrity of the downloaded content by verifying its corresponding signature. The signing and verification process ensures that the downloaded files were not modified or tampered since their creation and thus prevents anyone to use corrupted files.
On GNU/Linux, the most common way for verifying the PGP signature is to use
GnuPG. First ensure that GnuPG is installed
on your system. Then download the archive and its PGP signature and use the
gpg2 command to check the integrity of the archive against its
signature.
$ wget www.meso-star.com/solstice/downloads/Archive-Name-GNU-Linux64.tar.gz $ wget www.meso-star.com/solstice/downloads/Archive-Name-GNU-Linux64.tar.gz.sig $ gpg2 --verify Archive-Name-GNU-Linux64.tar.gz.sig
The first time you may obtain the likely output:
gpg: Signature made Wed 20 Sep 2017 08:28:35 AM CEST using RSA key 7322B68F7896C455 gpg: Can't check signature: No public key
This means that you do not have the public part of the PGP key used to sign
this archive. In the previous example the key identifier is
7322B68F7896C455. Use gpg2 to download this key from
the PGP keyserver.
$ gpg2 --keyserver hkps://hkps.pool.sks-keyservers.net --recv-keys 7322B68F7896C455
Now you can check the integrity of the archive with respect to the previously downloaded public-key.
$ gpg2 --verify Archive-Name-GNU-Linux64.tar.gz.sig
gpg: assuming signed data in 'Archive-Name-GNU-Linux64.tar.gz'
gpg: Signature made Tue 26 Sep 2017 09:28:40 AM CEST
gpg: using RSA key 1F494948BAA4F5F4A0AF82FF7322B68F7896C455
gpg: Good signature from "Vincent Forest (http://www.meso-star.com)
gpg: <vincent.forest@meso-star.com>" [ultimate]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 20EB E4CF 3D9F 4B9A E55D 5F59 679F 2975 93B2 C8A2
Subkey fingerprint: 1F49 4948 BAA4 F5F4 A0AF 82FF 7322 B68F 7896 C455
Note that GnuPG warns that the key is not certified. In other words you
cannot be sure that the key used to sign the archive really belongs to the
owner. The best option is to physically meet the actual owner and ask for him
about the key validity. More simply, but also less secure, you can review the
list of signatures of the key with gpg2 --list-sigs and then make a
decision whether you trust that key or
not.
On Windows, you can use the GPG4Win tool to verify the archive signature. The process is roughly the same that on GNU/Linux: you first have to import the public key used to sign the archive before verifying its integrity and checking that the imported key really belongs to the owner.
