Open j-flat opened 1 year ago
similiar issue , one cant verify due to missing public key?
gpg --import talos-pgp.key
gpg: key CCE0DFD21EC1A9BF: 1 signature not checked due to a missing key
gpg: key CCE0DFD21EC1A9BF: "Talos (Talos, Cisco Systems Inc.) <research@sourcefire.com>" not changed
gpg: Total number processed: 1
gpg: unchanged: 1
will result in
gpg --verify clamav-1.0.1.linux.x86_64.rpm.sig clamav-1.0.1.linux.x86_64.rpm
gpg: Signature made Mon Feb 13 14:28:00 2023 UTC
gpg: using RSA key 609B024F2B3EDD07
gpg: Can't check signature: No public key
-> currently there seems no way to verify signatures?
@j-flat @amsnek I'm asking for guidance internally. The files were signed with the old GPG key before it expired, and we haven't re-signed stuff in the past after keys expired. But I'm not sure what is best practice. I have a feeling we need to upload new GPG sigs with the new key. I'll let you know what happens.
Great to hear that you're on it @micahsnyder !
Any updates on this one?
@micahsnyder we are also facing the same issues . Can you please provide any updates ?
I know this is an old thread, but was looking for answers myself with the same errors given attempting to get a trusted signature showing. ClamAV does give their public key which was able to use to verify the .deb download. I followed the following site for some how-to's: https://www.linuxbabe.com/security/verify-pgp-signature-software-downloads-linux
https://www.clamav.net/downloads Scroll down to Trusted PGP Public Key.
At https://www.clamav.net/downloads, bottom of the site you have Talos PGP Public Key. Copy it and, by using Kleopatra, paste it to its notepad and import notepad. After this done you simply decrypt/check files by selecting the installation file (.deb, .rpm, etc). Just make sure signature file is within the same folder/catalog.
Describe the bug
The public key signature has expired for ClamAV public key making it impossible to verify the signature for
gzipped
source. When attempting to verify the signature for e.g.v1.0.1
I get this error:How to reproduce the problem
On our docker-image building process we download the source and build
ClamAV
binaries with shell-script close to following:The
gpg
command outputs the above mentioned error. Since we rely on exit code 0 on the build-process our build fails on this.Attachments
N/A