search

oneclick / rubyinstaller.org-website

Jekyll based rubyinstaller.org website
https://rubyinstaller.org
13 stars 46 forks source link

GPG Verify rubyinstaller-devkit-3.0.2-1-x64.exe #21

Open larskanis opened 3 years ago

larskanis commented 3 years ago

Hi,

I did below mentioned steps to verify rubyinstaller-devkit-3.0.2-1-x64.exe file. OS: Windows 10

Import signing key

gpg --import ci.ri2-package-signing-key.asc gpg: key 30B77F3A: "ci.ri2 package signing key" not changed gpg: Total number processed: 1 gpg: unchanged: 1

Verify Downloaded File

gpg --verify rubyinstaller-devkit-3.0.2-1-x64.exe.asc gpg: assuming signed data in 'rubyinstaller-devkit-3.0.2-1-x64.exe' gpg: Signature made 07/10/21 01:46:32 Standard Time using RSA key ID AAE32BA7 gpg: Can't check signature: No public key

I downloaded signing key from https://rubyinstaller.org/ci.ri2-package-signing-key.asc. So far I was not able to verify the download. Is the signing key updated for new versions of Rubyinstaller?

Thank You, Chamal.

larskanis commented 3 years ago

The sign process before upload doesn't specify the key to be used. This seems to have mixed up the signature keys of uploaded files. I'll fix this.

dimasfs07 commented 2 years ago

I have same problem with verify gpg. So is there a solution ?