Package signatures - Revision history

Vvs at 06:01, 17 July 2020

2020-07-17T06:01:07Z

2016-05-08T19:34:55Z

missing period

2016-05-08T19:33:29Z

check fingerprint

2011-11-30T11:24:06Z

‎From the default keyserver: copy-paste real gpg output

2011-11-30T11:22:24Z

‎From the default keyserver: get the unique key

2011-11-30T09:44:54Z

‎Checking the signature: fix missing bracket

2009-02-06T15:07:22Z

‎OpenVZ public key: add some more public keyservers

2009-02-06T15:02:34Z

‎OpenVZ public key: added keys.gnupg.net

2009-02-06T14:57:59Z

‎OpenVZ public key: added pgp.surfnet.nl

2009-02-06T14:56:05Z

‎OpenVZ public key: added keys.keysigning.org

← Older revision		Revision as of 06:01, 17 July 2020
Line 1:		Line 1:
		+	OpenVz7 packages are the same binaries as Virtuozzo7 and signed by Virtuozzo GPG key
		+	[http://repo.virtuozzo.com/vzlinux/security/VIRTUOZZO_GPG_KEY]
		+
		+	Info below is related to OpenVz legacy packages.
		+
	All the packages that are released by OpenVZ project are digitally signed by OpenVZ GPG key. Thus, you can check that those packages are indeed came from OpenVZ.		All the packages that are released by OpenVZ project are digitally signed by OpenVZ GPG key. Thus, you can check that those packages are indeed came from OpenVZ.

@@ Line 24: / Line 24: @@
 == Checking RPM packages ==
-RPM package manager has a build-in GPG signatures support. Signatures are embedded into the .rpm files, and public keys are stored in an rpm database In order to check OpenVZ RPM package signatures, you need to import OpenVZ public key to your RPM database. To that effect, do the following (usually you are required to be root):
+RPM package manager has a build-in GPG signatures support. Signatures are embedded into the .rpm files, and public keys are stored in an rpm database. In order to check OpenVZ RPM package signatures, you need to import OpenVZ public key to your RPM database. To that effect, do the following (usually you are required to be root):
 <pre>
 # rpm --import RPM-GPG-Key-OpenVZ

@@ Line 39: / Line 39: @@
 === Importing the public key ===
-First, you need to import OpenVZ public key to your GnuPG keychain. You can either import a local file, or search for the key on one of the public keyservers.
+First, you need to import OpenVZ public key to your GnuPG keychain. You can either import a local file, or search for the key on one of the public keyservers. Second, you should verify the key against the fingerprint.
 ==== From a local file ====
@@ Line 68: / Line 68: @@
 gpg: requesting key A7A1D4B6 from hkp server pgp.mit.edu
 ...
 </pre>

@@ Line 49: / Line 49: @@
 <pre>
 $ gpg --search-keys security@openvz.org
-gpg: searching for "OpenVZ" from hkp server subkeys.pgp.net
+gpg: searching for "security@openvz.org" from hkp server keys.gnupg.net
-(1)     OpenVZ Project <security@openvz.org>
+(1)	OpenVZ Project <security@openvz.org>
 bit DSA key A7A1D4B6, created: 2005-09-14
-Keys 1-1 of 1 for "OpenVZ".  Enter number(s), N)ext, or Q)uit > 1
+Keys 1-1 of 1 for "security@openvz.org".  Enter number(s), N)ext, or Q)uit > 1
-gpg: requesting key A7A1D4B6 from hkp server subkeys.pgp.net
+gpg: requesting key A7A1D4B6 from hkp server keys.gnupg.net
-...
+gpg: key A7A1D4B6: public key "OpenVZ Project <security@openvz.org>" imported
 </pre>

@@ Line 48: / Line 48: @@
 ==== From the default keyserver ====
 <pre>
-$ gpg --search-keys OpenVZ
+$ gpg --search-keys security@openvz.org
 gpg: searching for "OpenVZ" from hkp server subkeys.pgp.net
 (1)     OpenVZ Project <security@openvz.org>

@@ Line 70: / Line 70: @@
 === Checking the signature ===
-To check the signature, you need to have both the main file (e.g. the template tarball) and the signature file (the one which ends in <tt>.asc</tt>. Assuming you want to check the signature of <tt>centos-4-i386-default.tar.gz</tt> file:
+To check the signature, you need to have both the main file (e.g. the template tarball) and the signature file (the one which ends in <tt>.asc</tt>).
 <pre>
 $ gpg --verify centos-4-i386-default.tar.gz.asc

@@ Line 11: / Line 11: @@
 OpenVZ public key is available from the several sources. We urge you to use a few different sources because chances are lower they all can be compromised at the same time.
-* [http://openvz.org/download/RPM-GPG-Key-OpenVZ.txt RPM-GPG-Key-OpenVZ] Main site
+* [http://old.openvz.org/download/RPM-GPG-Key-OpenVZ.txt RPM-GPG-Key-OpenVZ] Old main site
 * [http://download.openvz.org/RPM-GPG-Key-OpenVZ RPM-GPG-Key-OpenVZ] Download site
 * [http://pgpkeys.pca.dfn.de/pks/lookup?op=get&search=0x92A60DA6A7A1D4B6 RPM-GPG-Key-OpenVZ] wwwkeys.de.pgp.net
@@ Line 17: / Line 17: @@
 * [http://keys.keysigning.org:11371/pks/lookup?op=get&search=0x92A60DA6A7A1D4B6 RPM-GPG-Key-OpenVZ] keys.keysigning.org
 * [http://pgp.surfnet.nl:11371/pks/lookup?op=get&search=0x92A60DA6A7A1D4B6 RPM-GPG-Key-OpenVZ] pgp.surfnet.nl
-* [http://keys.gnupg.net/pks/lookup?op=get&search=0x92A60DA6A7A1D4B6 PM-GPG-Key-OpenVZ] keys.gnupg.net
+* [http://keys.gnupg.net/pks/lookup?op=get&search=0x92A60DA6A7A1D4B6 RPM-GPG-Key-OpenVZ] keys.gnupg.net
 Key fingerprint = DEAB A031 F0A1 8848 9D71  01D2 92A6 0DA6 A7A1 D4B6