On Fri, Jan 31, 2025 at 09:57:24AM +0000, Andrew Gallagher wrote:
> On 30 Jan 2025, at 23:15, Josef Wolf <j...@raven.inka.de> wrote:
> >
> > I am trying to verify signature of downloaded files when creating a docker
> > container. This is what I am trying to do within the Dockerfile:
>
> Perhaps it would be easier to use gpgv?
>
> https://www.gnupg.org/documentation/manuals/gnupg/gpgv.html
Thanks for the pointer, Andrew! This works. Just one addiotional note: gpgv
don't have --recipient-file switch, so the pubkey needs to be de-armored:
RUN gpg --yes -o release-key.gpg --dearmor release-key.txt
RUN gpgv --keyring ./release-key.gpg sigfile.asc foo.tar.gz
A --recipient-file (or --public-key-asc-file or something) would be a nice
addition to gpgv
Thanks!
--
Josef Wolf
j...@raven.inka.de
_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
https://lists.gnupg.org/mailman/listinfo/gnupg-users
