How do I check or verify a pgp/gpg signature using a .asc PGP signature file? (Can't check signature: No public key)

Question

I'm installing the Ultimaker Cura 3D printer slicer program from here (https://github.com/Ultimaker/Cura/releases/tag/5.1.0) onto Linux Ubuntu 20.04.

I downloaded these 2 files:

Ultimaker-Cura-5.1.0-linux-modern.AppImage
Ultimaker-Cura-5.1.0-linux-modern.AppImage.asc

Opening the .asc file in a text editor shows it contains:

How do I use this .asc signature file to check the main file?

I read this page, and the last example seems to apply: https://www.gnupg.org/gph/en/manual/x135.html

So I tried this:

gpg --verify Ultimaker-Cura-5.1.0-linux-modern.AppImage.asc Ultimaker-Cura-5.1.0-linux-modern.AppImage

...and I got the following error, as shown in my run output:

~/Downloads/Install_Files/Cura$ gpg --verify Ultimaker-Cura-5.1.0-linux-modern.AppImage.asc Ultimaker-Cura-5.1.0-linux-modern.AppImage
gpg: Signature made Tue 19 Jul 2022 05:40:33 AM MST
gpg:                using RSA key 1889EAED2DB93BF7DFFB3CA6C1A1B91069C4AF59
gpg: Can't check signature: No public key

I tried following the solution in this answer, using the RSA key hash printed in the previous output above, and it doesn't work either:

$ gpg --receive-keys 1889EAED2DB93BF7DFFB3CA6C1A1B91069C4AF59
gpg: keyserver receive failed: Server indicated a failure

I'm looking around: Google search for "ultimaker public key"

If you run that command to import the public you, you will then be able to verify your Download using the .asc signature file. Note that this example is using the key ID, C1A1B91069C4AF59, but you can also use the key fingerprint, 1889EAED2DB93BF7DFFB3CA6C1A1B91069C4AF59, and you'll get the same key.

Update

Running gpg --keyserver pgp.mit.edu --recv-keys 1889EAED2DB93BF7DFFB3CA6C1A1B91069C4AF59 works for me without an error; the resulting key is:

But there is no reason for you to trust this key. Because neither the key, nor the fingerprint, nor the key id is published by the project in any official location, there's no reason for you to trust the key. Yes, it matches the key used to signed the file, but is this actually a key used by the project, or was it a clever hacker? I mean, sure, it's probably the right key, but the way the project is using it isn't particularly useful for anything other than checking if your download was somehow corrupted in transit.

Thank you. I just saw that post too, right before you posted it. I'm getting this error though. My command: `gpg --keyserver pgp.mit.edu --recv-keys 1889EAED2DB93BF7DFFB3CA6C1A1B91069C4AF59`. Error: `gpg: keyserver receive failed: Server indicated a failure`. Is it working for you? — Gabriel Staples, Jul 31 '22 at 23:54
larsks, this may help you help me: https://cloudsmith.io/~ultimaker/repos/cura-public/signing/ (I'm not sure what to do with this though, yet) — Gabriel Staples, Jul 31 '22 at 23:56
Manually going to this page (https://pgp.mit.edu/) and copy-pasting the key as a search string returns no results too. `No results found No results found: No keys found` — Gabriel Staples, Jul 31 '22 at 23:59
I found the key manually in the browser, here: https://pgp.mit.edu/pks/lookup?op=get&search=0xC1A1B91069C4AF59. The instructions (https://pgp.mit.edu/extracthelp.html) say: "If you want to look up a key by its hexadecimal KeyID, you have to prefix the ID with `0x`". So, searching for "Search STring" `0x1889EAED2DB93BF7DFFB3CA6C1A1B91069C4AF59` instead of `1889EAED2DB93BF7DFFB3CA6C1A1B91069C4AF59` _does_ work in the browser. I'm still not sure why my command isn't working at the command-line, however. — Gabriel Staples, Aug 01 '22 at 00:11
What OS are you on? And what version of `gpg` do you have? My `gpg --version` shows: `gpg (GnuPG) 2.2.19` — Gabriel Staples, Aug 01 '22 at 00:17
I'm on Linux (fedora 35) with `gpg` version `2.3.4`. It looks like 2.2.19 is a few years old. — larsks, Aug 01 '22 at 00:27

How do I check or verify a pgp/gpg signature using a .asc PGP signature file? (Can't check signature: No public key)

Related

1 Answers1

Linked